Bulkit
Register

Generating API Keys

Create and manage Bulkit credentials for server-to-server integrations.

Last updated · Markdown version

Bulkit keys identify your application and authorize requests made on behalf of your account.

Use this page when you need to:

  • create credentials for a new integration
  • rotate a key after a security incident
  • separate production and staging access

Where to generate API keys

Generate keys from the Bulkit dashboard in the API Keys section (/api-keys).

Creating a Key

To create a key, simply click New API Key and enter a descriptive Key Name (for example, Production Backend, Staging CRM, or Zapier Sync).

Each managed API key includes:

  • api_key: Your primary API Token prefixed with bk_live_. Pass this as Authorization: Bearer <api_key>.
  • api_secret: An optional secret hash kept for backward compatibility with older legacy dual-header systems.
  • Usage metadata: real-time last-used timestamp and active toggle status.

For all v2 API endpoints (SMS, WhatsApp, Contacts, Credits), you only need the API Key passed via Authorization: Bearer <api_key>. You do not need to pass an API Secret.

Webhooks are not tied to individual API keys. Bulkit provides a dedicated Webhooks tab inside /api-keys where you configure two account-level endpoints: DLR Webhook URL and Inbox Webhook URL. Read more in Webhooks Overview.

Why API keys matter

API keys allow Bulkit to:

  • associate requests with your account
  • enforce access control
  • track API usage
  • safely isolate one integration from another

Recommended key management practices

Store your API credentials in environment variables or a secret manager.

Never expose your API token in browser-based JavaScript, mobile binaries, or public client-side code.

Use the following operational practices:

  • create separate keys for production and staging
  • create separate keys for separate applications or services
  • rotate keys immediately if they are exposed
  • disable keys you no longer use

Example environment variable

cURL / Bash
export BULKIT_API_TOKEN="bk_live_8n6JQv3K1h9Lp0Md"

Legacy compatibility

Bulkit continues to support legacy dual-header credentials (X-API-Key and X-API-Secret) for older integrations. For new integrations, simply pass Authorization: Bearer <your_api_key>.

What to do after key generation

After you create a key:

  1. save the token in a secure location (e.g. your .env file)
  2. verify access with Get Account Balance
  3. send a test message using How to Send SMS or WhatsApp Overview
PreviousQuickstartNextAuthentication Overview