# Authentication overview

Every Instasent API authenticates with credentials issued in the dashboard — but each API has its own flavour. This page is the map: which credential you need, per API.

**Language:** en
**Audience:** developer
**TLDR:** Each API uses its own credential: Product API takes an API token or OAuth via Connected apps, Ingest API a datasource token, A2P Messaging API (HTTP) an api_sms token, SMPP a system_id/password bind, and Legacy API a bearer token. All but SMPP are sent in the Authorization header; tokens are shown once at creation, so use the narrowest-scoped credential available.
**Search keywords:** api key, api token
**Docs index (every page):** https://docs.instasent.com/llms.txt
**This page:** https://docs.instasent.com/developers/getting-started/authentication/ (HTML) · https://docs.instasent.com/developers/getting-started/authentication.md (Markdown)

Every Instasent API authenticates with credentials issued in the
[dashboard](https://dashboard.instasent.com) under **API tokens**. What changes
between APIs is the kind of credential and how it travels. This page is the
cross-API map; each API's own Authentication page has the full detail.

## Which credential do I need?

| API                      | Credential                                                                                                                                              | How it travels                                        |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| Product API              | **API token** (organization- or project-scoped), or **[Connected apps (OAuth)](/developers/product-api/connected-apps-and-oauth)** for third-party apps | `Authorization` header                                |
| Ingest API               | **Datasource token** (or a Product token with Ingest scopes)                                                                                            | `Authorization` header                                |
| A2P Messaging API — HTTP | **`api_sms` token**, scoped per project                                                                                                                 | `Authorization` header (query string for quick tests) |
| A2P Messaging API — SMPP | **`system_id` + `password`** per session, exposed by the `api_sms` token once SMPP is enabled                                                           | `bind` PDU                                            |
| Legacy API               | **Bearer token** issued in the dashboard                                                                                                                | `Authorization` header                                |

Two rules hold everywhere: tokens are shown **once** at creation, so copy them
right away — and they grant only the scopes you check off, so prefer the
narrowest credential that does the job (a datasource token over a full Product
token, a per-project `api_sms` token over anything broader).

## Per-API guides

- [Product API — API tokens](/developers/product-api/authentication) - Organization- or project-scoped bearer tokens for your own server-side integrations — the credential your own backend carries.
- [Product API — Connected apps (OAuth)](/developers/product-api/connected-apps-and-oauth) - The other way into the Product API: each customer authorizes your app and you never handle their credentials. This is the one you want if you are **building an app other customers will install** — not integrating your own backend.
- [Ingest API](/developers/ingest-api/authentication) - Datasource tokens that can only touch their own datasource — the right scope for CRM and event integrations.
- [A2P Messaging API — HTTP](/developers/transactional-api/http/authentication) - The `api_sms` project token: create, send, rotate.
- [A2P Messaging API — SMPP](/developers/transactional-api/smpp/authentication) - Per-session `system_id` + `password` on the bind, issued once SMPP is enabled on the account.
- [Legacy API](/developers/legacy-api/authentication) - The first-generation bearer token, for existing integrations.

---

This is one page of the Instasent documentation. For the complete machine-readable index of every guide and API reference, fetch https://docs.instasent.com/llms.txt — start there for full context.