---
title: "Send SMS Using Header Authorization"
description: "Send SMS requests with API credentials passed in request headers."
---

# Send SMS Using Header Authorization

Header authorization using a single Bearer token is the recommended way to send SMS from server-side applications because credentials stay out of URLs and logs.

## Endpoints

```http
POST /api/v2/messages/sms
POST /api/v2/messages/sms/bulk
```

## Authorization

Use standard Bearer authorization:

```http
Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md
Content-Type: application/json
```

<Info>
Legacy dual headers (`X-API-Key` & `X-API-Secret`) remain supported for existing integrations.
</Info>

## Request example

<CodeGroup>

```bash curl
curl -X POST "https://api.bulkitsms.com/api/v2/messages/sms" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md" \
  -d '{
    "sender": "BULK_IT",
    "mobile": "254700000001",
    "message": "Your Bulkit verification code is 482193."
  }'
```

```python python.py
import requests

response = requests.post(
    "https://api.bulkitsms.com/api/v2/messages/sms",
    headers={
        "Authorization": "Bearer bk_live_8n6JQv3K1h9Lp0Md",
    },
    json={
        "sender": "BULK_IT",
        "mobile": "254700000001",
        "message": "Your Bulkit verification code is 482193.",
    },
    timeout=30,
)
print(response.json())
```

```go main.go
package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	body, _ := json.Marshal(map[string]interface{}{
		"sender":  "BULK_IT",
		"mobile":  "254700000001",
		"message": "Your Bulkit verification code is 482193.",
	})

	req, _ := http.NewRequest(http.MethodPost, "https://api.bulkitsms.com/api/v2/messages/sms", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer bk_live_8n6JQv3K1h9Lp0Md")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	fmt.Println(resp.Status)
}
```

```php php
<?php

$payload = [
    "sender" => "BULK_IT",
    "mobile": "254700000001",
    "message": "Your Bulkit verification code is 482193."
];

$ch = curl_init("https://api.bulkitsms.com/api/v2/messages/sms");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "Authorization: Bearer bk_live_8n6JQv3K1h9Lp0Md",
    ],
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
]);

echo curl_exec($ch);
curl_close($ch);
```

</CodeGroup>

## Notes

- use Bearer authorization for backend services and worker processes
- pass your sender name directly in `"sender": "BULK_IT"` (or `"sender_id"` with UUID for legacy integrations)
- keep API tokens in environment variables, not frontend code
- for bulk SMS, use `/api/v2/messages/sms/bulk` with `"mobiles": ["254700000001", "254711111111"]`

## Error response

```json
{
  "status": "error",
  "message": "Invalid API Key or Secret"
}
```