Security & Compliance

Enterprise-grade security for mission-critical messaging

Sendblue powers messaging for Fortune 100 companies and top enterprises worldwide.

Authentication

API credentials use SHA-512 HMAC hashing with unique salts. Plaintext secrets are never stored.

sb-api-key-id: YOUR_API_KEY
sb-api-secret-key: YOUR_API_SECRET

Alternative header formats also accepted:

x-sb-api-key-id: YOUR_API_KEY
x-sb-api-secret-key: YOUR_API_SECRET

All requests require both headers. Frontend requests are blocked—API calls must come from your backend.

Configure signing secrets per-webhook or globally:

{
  "webhooks": [{
    "url": "https://yourapp.com/webhook",
    "secret": "your-secret"
  }],
  "globalSecret": "optional-global-secret"
}

Sendblue sends sb-signing-secret header with requests. Verify this matches your configured secret.

Multi-level protection:

Level	Purpose
Account	Prevents runaway scripts
Server	Protects infrastructure
Sender	Prevents carrier flagging
Conversation	Respects recipient experience

Rate limits vary by plan.

Built-in opt-out detection for: stop, unsubscribe, cancel, opt out, revoke, end, quit

Opt-in via start. Custom opt-out phrases supported per account.

All API requests logged with sanitized headers
Request tracing with unique IDs
Sensitive headers auto-redacted: authorization, sb-api-key-id, sb-api-secret-key, x-id-token, cookie