Authentication overview
Every Instasent API authenticates with credentials issued in the dashboard — but each API has its own flavour. This page is the map: which credential you need, per API.
Every Instasent API authenticates with credentials issued in the dashboard under API tokens. What changes between APIs is the kind of credential and how it travels. This page is the cross-API map; each API's own Authentication page has the full detail.
Which credential do I need?
| API | Credential | How it travels |
|---|---|---|
| Product API | API token (organization- or project-scoped), or Connected apps (OAuth) for third-party apps | Authorization header |
| Ingest API | Datasource token (or a Product token with Ingest scopes) | Authorization header |
| A2P Messaging API — HTTP | api_sms token, scoped per project | Authorization header (query string for quick tests) |
| A2P Messaging API — SMPP | system_id + password per session, exposed by the api_sms token once SMPP is enabled | bind PDU |
| Legacy API | Bearer token issued in the dashboard | Authorization header |
Two rules hold everywhere: tokens are shown once at creation, so copy them
right away — and they grant only the scopes you check off, so prefer the
narrowest credential that does the job (a datasource token over a full Product
token, a per-project api_sms token over anything broader).
Per-API guides
Organization- or project-scoped bearer tokens for your own server-side integrations — the credential your own backend carries.
Product API — Connected apps (OAuth)The other way into the Product API: each customer authorizes your app and you never handle their credentials. This is the one you want if you are building an app other customers will install — not integrating your own backend.
Ingest APIDatasource tokens that can only touch their own datasource — the right scope for CRM and event integrations.
A2P Messaging API — HTTPThe api_sms project token: create, send, rotate.
Per-session system_id + password on the bind, issued once SMPP is
enabled on the account.
The first-generation bearer token, for existing integrations.