Every request needs two factors and both must be present. Factor one is your personal Bearer token, simbearer_<prefix>_<secret>. Factor two is your customer-group API key, sent as X-Customer-API-Key or X-simsonic-API-Key, in the form simdev_<prefix>_<secret>. Both are generated on the Developer page of the console at management.simsonic.com, and the key is scoped to a customer group: it sees that customer and its sub-customers, never upwards.
Your first call
# list your subscribers: proves both factors work
curl \
-H "Authorization: Bearer simbearer_<prefix>_<secret>" \
-H "X-Customer-API-Key: simdev_<prefix>_<secret>" \
"https://management.simsonic.com/developer/api/sims/"Tip
Keep both factors server-side. Rate limits are enforced per user and customer group: 10 requests per 10s burst, 60 a minute, 1,500 an hour and at least 5s between list requests. Over the limit the API returns 429 with a Retry-After header.