Authentication Overview

Bulkit v2 authenticates API requests using a simple, single API token passed via the standard Authorization: Bearer header.

Preferred method (Bearer Token)

Standard HTTP Bearer authentication is the recommended option for all v2 API endpoints. It keeps requests simple, secure, and compatible with standard HTTP tooling:

Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md

Example request:

curl -X GET "https://api.bulkitsms.com/api/v2/account/credits" \
  -H "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md"

Legacy and alternative methods

For backward compatibility, Bulkit continues to support alternative credential formats:

1. Dual-header authorization

X-API-Key: bk_live_8n6JQv3K1h9Lp0Md
X-API-Secret: sk_live_4jPzT5uN8xA1rC6

2. Basic Auth

3. URL query parameter authorization

GET /api/v2/account/credits?apikey=bk_live_8n6JQv3K1h9Lp0Md

Failed authentication behavior

If authentication fails, Bulkit returns an HTTP 401 response:

{
  "status": "error",
  "message": "Invalid API Key or Secret"
}

Common causes:

• missing Authorization: Bearer <token> header
• wrong or deactivated API token
• expired session or deleted key

Choosing the right method

• Always use Authorization: Bearer <token> for new integrations, production services, and high-volume traffic.
• Use query parameter ?apikey=<token> only for quick browser testing when custom headers cannot be set.

Related pages

• Header Authorization
• URL Authorization