---
title: "Send SMS Using URL Params"
description: "Send SMS requests when your integration can only pass credentials in query parameters."
---

# Send SMS Using URL Params

URL parameter authorization is supported for constrained integrations, but it should be used carefully because query strings are easier to log and expose.

## Endpoints

```http
POST /api/v2/messages/sms/bulk?apikey=bk_live_...
```

## Authorization

Send your API key as a query parameter:

```http
?apikey=bk_live_...
```

<Note>
**Legacy compatibility**: Passing both `apikey` and `apisecret` as query parameters (`?apikey=...&apisecret=...`) remains fully supported for backward compatibility.
</Note>

## Example request

<CodeGroup>

```bash curl
curl -X POST "https://api.bulkitsms.com/api/v2/messages/sms/bulk?apikey=bk_live_8n6JQv3K1h9Lp0Md" \
  -H "Content-Type: application/json" \
  -d '{
    "sender": "BULK_IT",
    "mobiles": ["254700000001"],
    "message": "Your order BK-2401 has shipped."
  }'
```

```python python.py
import requests

response = requests.post(
    "https://api.bulkitsms.com/api/v2/messages/sms/bulk",
    params={
        "apikey": "bk_live_8n6JQv3K1h9Lp0Md",
    },
    json={
        "sender": "BULK_IT",
        "mobiles": ["254700000001"],
        "message": "Your order BK-2401 has shipped.",
    },
    timeout=30,
)
print(response.json())
```

```go main.go
package main

import (
	"bytes"
	"encoding/json"
	"net/http"
)

func main() {
	body, _ := json.Marshal(map[string]interface{}{
		"sender":  "BULK_IT",
		"mobiles": []string{"254700000001"},
		"message": "Your order BK-2401 has shipped.",
	})

	req, _ := http.NewRequest(http.MethodPost, "https://api.bulkitsms.com/api/v2/messages/sms/bulk?apikey=bk_live_8n6JQv3K1h9Lp0Md", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}
```

```php php
<?php

$payload = [
    "sender" => "BULK_IT",
    "mobiles" => ["254700000001"],
    "message": "Your order BK-2401 has shipped."
];

$url = "https://api.bulkitsms.com/api/v2/messages/sms/bulk?apikey=bk_live_8n6JQv3K1h9Lp0Md";
$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ["Content-Type: application/json"],
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
]);

echo curl_exec($ch);
curl_close($ch);
```

</CodeGroup>

<Warning>
Prefer header authorization in production. URL params are more likely to appear in logs, browser history, and proxy traces.
</Warning>

## Error response

```json
{
  "status": "error",
  "message": "Invalid credentials"
}
```