Idempotency-Key
Send the same key twice on a write and QuickGrow replays the original response — no duplicate message, no guesswork.
Developers
One endpoint for every channel.
Send email, SMS, and WhatsApp from a single REST call — with idempotent writes, per-key rate limits, signed webhooks, and copy-paste samples in cURL, Node, Python & PHP.
Idempotent writesHMAC-signed webhooks cURL · Node · Python · PHP
POST /api/v1/messages
curl https://server.quickgrow.ai/api/v1/messages \ -H "X-API-Key: mk_live_..." \ -H "Idempotency-Key: 8f2a" \ -H "Content-Type: application/json" \ -d '{ "channel": "whatsapp", "to": "+8801700000000", "template": "order_shipped" }' # → 202 { "id": "msg_9fA2", "status": "queued" }
01One call
Send anything, one call.
POST /api/v1/messages handles email, SMS, and WhatsApp; get a message by id or list your history. Across 23 endpoints, contacts, templates, analytics, and webhooks are all first-class API resources.
Email · SMS · WhatsApp23 endpointsContacts · Templates · Analytics · Webhooks
GET /api/v1/messages/:id
{
"id": "msg_9fA2",
"channel": "whatsapp",
"status": "delivered",
"to": "+8801700000000",
"created_at": "2026-08-10T09:14:22Z"
}
# list: GET /api/v1/messages?limit=5002Reliability
Safe to retry — by design.
An Idempotency-Key on any write replays the original response, so a dropped connection never sends twice. A per-key limit of 1,000 requests per minute returns standard X-RateLimit-* headers, so your client always knows where it stands.
X-RateLimit-* headers
1,000 requests per minute per key, with limit, remaining, and reset headers on every response so you can back off cleanly before you hit a wall.
03API keys
Keys you can trust.
Authenticate with a single X-API-Key: mk_live_… header. Scope each key to least privilege across eight scopes — send and read messages, read and write contacts and templates, read analytics, and manage webhooks.
X-API-Key header8 granular scopesLeast privilege
api key · scoped
{
"prefix": "mk_live_9fA2...",
"scopes": [
"messages:send", "messages:read",
"contacts:write", "analytics:read"
]
}
# send with: X-API-Key: mk_live_...04Webhooks
Webhooks, signed and guarded.
Each delivery carries an HMAC-SHA256 X-QuickGrow-Signature you verify against your whsec_… secret, with a 300-second replay window. Failed deliveries are logged and retried automatically.
Four message events
Subscribe to the four message lifecycle events and verify the HMAC signature on every payload before you trust it. Deliveries are logged so you can replay and debug.
message.sentmessage.deliveredmessage.failedmessage.bounced
⚠ Automatic retries with backoff — not guaranteed delivery.
verify · node
import { createHmac } from "node:crypto";
const sig = req.headers["x-quickgrow-signature"];
const [t, v1] = sig.split(",").map((p) => p.split("=")[1]);
const expected = createHmac("sha256", process.env.QG_WEBHOOK_SECRET)
.update(`${t}.${req.rawBody}`)
.digest("hex");
// timing-safe compare v1 === expected, then trust05Samples & OpenAPI
Copy-paste samples, one public spec.
Every endpoint ships with ready-to-run samples in cURL, Node, Python, and PHP, covering messages, contacts, templates, analytics, and webhook verification. It's all described by a public OpenAPI spec you can read or import into your own tooling.
cURL · Node · Python · PHPOpenAPI spec
⚠ No SDK to install — call the REST API directly with the language of your choice.
get started
# Browse the interactive docs /api/public-docs # Import the machine-readable spec /api/public-docs/openapi.json # No install — just an X-API-Key header