---
title: "Authentication Overview"
description: "Learn how Bulkit authenticates API requests and which method to use in production."
---

# Authentication Overview

Bulkit v2 authenticates API requests using a simple, single API token passed via the standard `Authorization: Bearer` header.

## Preferred method (Bearer Token)

Standard HTTP Bearer authentication is the recommended option for all v2 API endpoints. It keeps requests simple, secure, and compatible with standard HTTP tooling:

```http
Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md
```

Example request:

```bash
curl -X GET "https://api.bulkitsms.com/api/v2/account/credits" \
  -H "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md"
```

## Legacy and alternative methods

For backward compatibility, Bulkit continues to support alternative credential formats:

### 1. Dual-header authorization
```http
X-API-Key: bk_live_8n6JQv3K1h9Lp0Md
X-API-Secret: sk_live_4jPzT5uN8xA1rC6
```

### 2. Basic Auth
```http
Authorization: Basic <base64(api_key:api_secret)>
```

### 3. URL query parameter authorization
```http
GET /api/v2/account/credits?apikey=bk_live_8n6JQv3K1h9Lp0Md
```

## Failed authentication behavior

If authentication fails, Bulkit returns an HTTP 401 response:

```json
{
  "status": "error",
  "message": "Invalid API Key or Secret"
}
```

Common causes:
- missing `Authorization: Bearer <token>` header
- wrong or deactivated API token
- expired session or deleted key

## Choosing the right method

- **Always use `Authorization: Bearer <token>`** for new integrations, production services, and high-volume traffic.
- Use query parameter `?apikey=<token>` only for quick browser testing when custom headers cannot be set.

## Related pages

- [Header Authorization](/authentication/header-authorization)
- [URL Authorization](/authentication/url-authorization)