---
title: "Generating API Keys"
description: "Create and manage Bulkit credentials for server-to-server integrations."
---

# Generating API Keys

Bulkit keys identify your application and authorize requests made on behalf of your account.

Use this page when you need to:

- create credentials for a new integration
- rotate a key after a security incident
- separate production and staging access

## Where to generate API keys

Generate keys from the Bulkit dashboard in the **API Keys** section (`/api-keys`).

### Creating a Key
To create a key, simply click **New API Key** and enter a descriptive **Key Name** (for example, `Production Backend`, `Staging CRM`, or `Zapier Sync`). 

Each managed API key includes:

- `api_key`: Your primary API Token prefixed with `bk_live_`. Pass this as `Authorization: Bearer <api_key>`.
- `api_secret`: An optional secret hash kept for backward compatibility with older legacy dual-header systems.
- Usage metadata: real-time last-used timestamp and active toggle status.

<Note>
For all v2 API endpoints (SMS, WhatsApp, Contacts, Credits), you only need the **API Key** passed via `Authorization: Bearer <api_key>`. You do not need to pass an API Secret.
</Note>

<Note>
Webhooks are not tied to individual API keys. Bulkit provides a dedicated **Webhooks** tab inside `/api-keys` where you configure two account-level endpoints: **DLR Webhook URL** and **Inbox Webhook URL**. Read more in [Webhooks Overview](/webhooks/overview).
</Note>

## Why API keys matter

API keys allow Bulkit to:

- associate requests with your account
- enforce access control
- track API usage
- safely isolate one integration from another

## Recommended key management practices

<Check>
Store your API credentials in environment variables or a secret manager.
</Check>

<Warning>
Never expose your API token in browser-based JavaScript, mobile binaries, or public client-side code.
</Warning>

Use the following operational practices:

- create separate keys for production and staging
- create separate keys for separate applications or services
- rotate keys immediately if they are exposed
- disable keys you no longer use

## Example environment variable

```bash
export BULKIT_API_TOKEN="bk_live_8n6JQv3K1h9Lp0Md"
```

## Legacy compatibility

Bulkit continues to support legacy dual-header credentials (`X-API-Key` and `X-API-Secret`) for older integrations. For new integrations, simply pass `Authorization: Bearer <your_api_key>`.

## What to do after key generation

After you create a key:

1. save the token in a secure location (e.g. your `.env` file)
2. verify access with [Get Account Balance](/account/get-account-balance)
3. send a test message using [How to Send SMS](/sms/overview) or [WhatsApp Overview](/whatsapp/overview)