Authentication

Every request goes over https and uses HTTP Basic auth. Plain http (port 80) answers 400 "use https" and is never redirected, so a request sent in the clear is never carried out. Use either:

• AccountSid:AuthToken, or
• ApiKeySid:ApiKeySecret (an SK… key), with your AccountSid in the path.

What to expect

• Wrong or missing credentials answer 401 with 20003, before anything is looked up.
• A key works only for its own account. A key of account A on /Accounts/B/… answers 401.
• A suspended account answers 401 with 20005.
• Repeated failures from one address are slowed down: after 10 in a minute, that address gets 429, 20429, for 15 minutes.

Console keys

Each account also has one API key of kind console. It can only read, and change phone-number settings: any other request with it answers 403, 20403.

Keep the AuthToken on your server

The API is server-to-server only and sends no CORS headers. Never put an AuthToken in a web page or a mobile app. Your AuthToken also signs every webhook we send you (see Webhooks).