---
title: "Header Authorization"
description: "Authenticate requests using request headers, the preferred method for production integrations."
---

# Header Authorization

Header authorization is the recommended authentication method for all Bulkit integrations.

It keeps your credentials out of URLs and reduces accidental exposure in logs, caches, analytics tools, and browser history.

## Exact header format

Bulkit v2 uses a single API token in the standard HTTP `Authorization` header:

```http
Authorization: Bearer your_actual_token_here
```

<Info>
Pass your API Key directly as the Bearer token. No need for dual headers (`X-API-Key` and `X-API-Secret`). For backward compatibility, legacy dual headers and HTTP Basic Auth remain supported.
</Info>

## Example

<CodeGroup>

```bash curl
curl -X GET "https://api.bulkitsms.com/api/v2/account/credits" \
  -H "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md"
```

```python python.py
import requests

response = requests.get(
    "https://api.bulkitsms.com/api/v2/account/credits",
    headers={
        "Authorization": "Bearer bk_live_8n6JQv3K1h9Lp0Md",
    },
    timeout=30,
)

print(response.status_code)
print(response.json())
```

```go main.go
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://api.bulkitsms.com/api/v2/account/credits", nil)
	if err != nil {
		panic(err)
	}

	req.Header.Set("Authorization", "Bearer bk_live_8n6JQv3K1h9Lp0Md")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}

	fmt.Println(resp.StatusCode)
	fmt.Println(string(body))
}
```

```php php
<?php

$ch = curl_init("https://api.bulkitsms.com/api/v2/account/credits");

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md",
    ],
]);

$response = curl_exec($ch);
$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response === false) {
    throw new Exception(curl_error($ch));
}

curl_close($ch);

echo $statusCode . PHP_EOL;
echo $response . PHP_EOL;
```

</CodeGroup>

## Legacy Dual Header Support

If your system already uses the legacy dual-header approach:

```http
X-API-Key: bk_live_8n6JQv3K1h9Lp0Md
X-API-Secret: sk_live_4jPzT5uN8xA1rC6
```

This continues to function seamlessly without breaking existing implementations.

## Best practices

- Keep tokens in server-side environment variables (`BULKIT_API_TOKEN`).
- Rotate credentials immediately if they are exposed.
- Do not reuse the same key across unrelated applications.
- Always use HTTPS.