sender-profile-architect

Sender Profile Architect

A Sender Profile is the operational boundary for tenant identity, channel configuration, inherited resources, billing, and credentials. Use this skill before provisioning when a poor boundary would mix brands, compliance posture, rate-limit impact, or webhook ownership.

Recommended tenancy model

When tenants require isolation, recommend one Sent organization with one Sender Profile per tenant. A shared profile is appropriate only when the tenants genuinely share one brand, sender resources, compliance posture, billing/rate-limit expectations, and operational blast radius.

Do not recommend pooled-by-default architecture. Make the isolation decision explicit using references/multi-tenancy-patterns.md.

Authentication patterns

Sent v3 supports both:

Pattern	Headers	Blast radius
Profile-specific API key	x-api-key	Profile-scoped credentials and rate-limit context. Do not add x-profile-id.
Organization API key acting for a child	x-api-key plus x-profile-id: <profile UUID>	Organization credential can reach permitted child profiles; rate limits remain in the organization pool.

Only organization keys may send x-profile-id. A profile key that sends it receives 403. A profile outside the organization returns 404. X-Profile-Id can be echoed in scoped responses.

x-sender-id is legacy v1/v2 terminology only. Do not use it for v3 authentication or routing.

Choose profile keys when tenant-level credential isolation and revocation are primary. Choose organization-key scoping for centrally controlled integrations that can protect a broader credential and deliberately accept a shared organization rate-limit pool.

Profile creation model

Create with POST /v3/profiles. name is required. Current optional areas include:

• identity: icon, description, short_name;
• sharing: allow_contact_sharing, allow_template_sharing;
• inheritance: inherit_contacts, inherit_templates, inherit_tcr_brand, inherit_tcr_campaign;
• billing: billing_model, billing_contact, and ephemeral payment_details;
• dedicated WABA credentials: whatsapp_business_account with waba_id, optional phone_number_id, and access_token;
• a dedicated brand: brand.contact, brand.business, and brand.compliance.