Authentication - KarFlows

KarFlows APIs use bearer tokens.

Authorization: Bearer YOUR_API_TOKEN

Tokens are product-specific:

Token prefix	Product
`kfsms_`	SMS REST API
`kfotp_`	OTP API
`kfmsg_`	Unified Messaging API
JWT token	WhatsApp QR REST API

Token safety

Keep API tokens on your server. Do not expose them in frontend JavaScript, mobile apps, or public repositories.

Store tokens in environment variables or a secrets manager.
Use a separate token for each KarFlows product.
Rotate a token immediately if it is exposed.
Treat rotation as a breaking credential change: the previous token stops working.

Disabled tokens

If an administrator disables a service, KarFlows immediately rejects public requests for that token. Common disabled responses:

{
  "success": false,
    "message": "Unified Messaging is not enabled for this customer"
}

{
  "success": false,
  "message": "Plan has expired"
}

Passing tokens in tests

Bearer headers are required for new integrations. Some legacy endpoints also accept token, apiKey, or api_key; do not use those forms in new code because URLs and request bodies are more likely to be logged.