# Authenticate with the BroadNet API

> Every REST request carries an Authorization: Bearer header with your BroadNet account's access token. A missing or invalid token returns 401 with a JSON error body. The legacy HTTP API (/websmpp) takes credentials as parameters and is kept only for existing SMPP-era integrations.

- Canonical URL: https://www.broadnet.me/developers/authentication
- Language: en
- Last updated: 2026-10-21
- Publisher: BroadNet (https://www.broadnet.me)

Every request to the BroadNet REST API carries your access token in an Authorization: Bearer header. The token is issued per account and comes from your BroadNet account; the API has no call that exchanges a username and password for a token. A missing or invalid token is rejected at the API gateway with HTTP 401 and a JSON body of two fields, error and message.

> **Never embed the token client-side** The access token grants send rights on your account. Keep it in an environment variable or a secrets manager, out of source control, mobile apps and browser code, and always call the API over HTTPS.

## Legacy /websmpp credentials

The legacy HTTP API under /websmpp, kept for SMPP-era integrations, takes credentials as request parameters (user and pass, or accesskey) instead of a Bearer token. Use it only if you already depend on it; new integrations should use the Bearer-token REST API.

## Examples

### authenticated request

```bash
curl -X POST https://api.broadnet.me/sms/identify \
  -H "Authorization: Bearer $BROADNET_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "message": "Hello from BroadNet" }'
```

Same header on every endpoint and every channel.

### 401 Unauthorized

```json
{
  "error": "Unauthorized",
  "message": "Missing Authorization token"
}
```

## Related

- [API authentication & signing standard](https://www.broadnet.me/reference/api-authentication-and-signing)
- [Quickstart](https://www.broadnet.me/developers/quickstart)