---
title: "URL Authorization"
description: "Authenticate requests with query parameters when header-based access is not practical."
---

# URL Authorization

Bulkit also supports URL-based authentication for workflows where sending custom headers is difficult. However, using the [`Authorization: Bearer <your_api_key>`](/authentication/header-authorization) header is strongly recommended.

## Exact query parameter format

```http
?apikey=your_api_key
```

<Note>
For backward compatibility, query parameters also accept `?apikey=your_api_key&apisecret=your_api_secret` or `?api_key=your_api_key`.
</Note>

## Example

```bash
GET https://api.bulkitsms.com/api/v2/account/credits?apikey=bk_live_8n6JQv3K1h9Lp0Md
```

## When to use it

URL authorization can be useful for:

- simple command-line testing
- constrained tools or webhooks that do not support custom headers
- quick connectivity checks in internal tooling

## Security caution

<Warning>
Avoid URL authorization in production whenever possible. Query parameters are more likely to be captured in logs, proxy traces, analytics tooling, and browser history.
</Warning>

## Example requests

<CodeGroup>

```bash curl
curl -X GET "https://api.bulkitsms.com/api/v2/account/credits?apikey=bk_live_8n6JQv3K1h9Lp0Md"
```

```python python.py
import requests

response = requests.get(
    "https://api.bulkitsms.com/api/v2/account/credits",
    params={
        "apikey": "bk_live_8n6JQv3K1h9Lp0Md",
    },
    timeout=30,
)

print(response.status_code)
print(response.json())
```

```go main.go
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	url := "https://api.bulkitsms.com/api/v2/account/credits?apikey=bk_live_8n6JQv3K1h9Lp0Md"

	resp, err := http.Get(url)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}

	fmt.Println(resp.StatusCode)
	fmt.Println(string(body))
}
```

```php php
<?php

$url = "https://api.bulkitsms.com/api/v2/account/credits?apikey=bk_live_8n6JQv3K1h9Lp0Md";
$response = file_get_contents($url);

if ($response === false) {
    throw new Exception("Request failed");
}

echo $response . PHP_EOL;
```

</CodeGroup>