Bulkit
Register

Header Authorization

Authenticate requests using request headers, the preferred method for production integrations.

Last updated · Markdown version

Header authorization is the recommended authentication method for all Bulkit integrations.

It keeps your credentials out of URLs and reduces accidental exposure in logs, caches, analytics tools, and browser history.

Exact header format

Bulkit v2 uses a single API token in the standard HTTP Authorization header:

HTTP
Authorization: Bearer your_actual_token_here

Pass your API Key directly as the Bearer token. No need for dual headers (X-API-Key and X-API-Secret). For backward compatibility, legacy dual headers and HTTP Basic Auth remain supported.

Example

cURL / Bash
curl -X GET "https://api.bulkitsms.com/api/v2/account/credits" \
  -H "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md"

Legacy Dual Header Support

If your system already uses the legacy dual-header approach:

HTTP
X-API-Key: bk_live_8n6JQv3K1h9Lp0Md
X-API-Secret: sk_live_4jPzT5uN8xA1rC6

This continues to function seamlessly without breaking existing implementations.

Best practices

  • Keep tokens in server-side environment variables (BULKIT_API_TOKEN).
  • Rotate credentials immediately if they are exposed.
  • Do not reuse the same key across unrelated applications.
  • Always use HTTPS.
PreviousAuthentication OverviewNextURL Authorization