Authentication with API keys

Every endpoint except the two pricing endpoints needs an API key in the Authorization header.

POST /v1/messages HTTP/1.1
Host: bulksmsapi.cc
Authorization: Bearer bsa_live_7QzX2mW9kR4tB8nV1cJ6yP3sH5dL0aFe
Content-Type: application/json

Creating keys

• Keys are created on the API keys page of the console. The page opens after the first top-up is added to the balance.
• An account can hold 10 active keys. Give each app or environment its own key and name, so one can be replaced without touching the others.
• A key is bsa_live_ followed by 32 letters and digits. It is shown once, when it is created; we keep only a keyed hash, so a lost key cannot be shown again. Create a new one instead.
• The list shows the first characters, the last four, when the key was created and when it was last used.

Rotating and revoking

To rotate a key without downtime: create a second key, deploy it, check its last-used time in the console, then revoke the old key. A revoked key answers 401 unauthorized from the next request on.

Keeping keys safe

• Call the API from your server, never from a browser or a mobile app: anyone with the key can send messages from your balance.
• Keep keys in environment variables or a secret manager, not in source control.
• Each key has its own rate limit counter, so a busy worker does not slow down a second key used elsewhere.

Errors

{
  "error": {
    "code": "unauthorized",
    "message": "Send your API key as Authorization: Bearer bsa_live_... Keys are created in the console under API keys.",
    "doc_url": "https://bulksmsapi.cc/en/docs/errors#unauthorized"
  }
}