Authentication Methods

THEITBULLS supports multiple authentication methods to secure your API requests. Choose the method that best fits your use case.

Method	Best For	Security Level
API Keys	Server-side applications	High
JWT Tokens	User authentication	High
OAuth2	Third-party integrations	Very High

1. API Keys

API keys are the simplest way to authenticate your requests. Include your API key in the Authorization header.

How to Get Your API Key

Log in to your dashboard
Navigate to Settings → API Keys
Generate a new key (Test or Live)
Copy and store securely

Using API Keys

     # Example: Send message with API key curl -X POST https://api.theitbulls.com/v1/whatsapp/messages \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "to": "911234567890", "text": "Hello!" }'
    

Important: Keep your API keys secret. Never expose them in client-side code or public repositories.

2. JWT Tokens

For user authentication, we support JSON Web Tokens (JWT). JWT tokens are generated after successful user login.

Generating a JWT Token

     # Login request curl -X POST https://api.theitbulls.com/v1/auth/login \ -H "Content-Type: application/json" \ -d '{ "email": "user@company.com", "password": "your_password" }' # Response { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "expires_in": 3600 }
    

Using JWT Tokens

     curl -X GET https://api.theitbulls.com/v1/account \ -H "Authorization: Bearer YOUR_JWT_TOKEN"
    

3. OAuth2

For third-party integrations and apps, we support OAuth2 with the authorization_code grant type.

OAuth2 Flow

Redirect users to our authorization endpoint
User approves access
We redirect back with an authorization code
Exchange code for an access token

Exchange Code for Token

     curl -X POST https://api.theitbulls.com/v1/oauth/token \ -H "Content-Type: application/json" \ -d '{ "grant_type": "authorization_code", "code": "AUTH_CODE", "client_id": "YOUR_CLIENT_ID", "client_secret": "YOUR_CLIENT_SECRET" }'
    

Security Best Practices

Use HTTPS: All API requests must be sent over HTTPS
Rotate Keys: Regularly rotate your API keys
Least Privilege: Use keys with minimal required permissions
Environment Variables: Store secrets in environment variables
Monitor Usage: Track API key usage for suspicious activity

Security Alert: If you suspect your API key has been compromised, regenerate it immediately from your dashboard.

Error Responses

Status Code	Error	Description
401	Unauthorized	Invalid or missing API key/token
403	Forbidden	API key lacks required permissions
429	Rate Limit	Too many requests, please slow down

Need help with authentication? Our team is here to assist.

Get Support