# Authentication

> Authenticate Edesy SIP-trunk and telephony API requests with a Bearer token — tenant API keys (vp_) or a session JWT. How numbers are tenant-scoped.

Source: https://edesy.in/docs/sip-trunk-for-ai-voice-agents/getting-started/authentication

All API requests are authenticated with a **Bearer token** in the `Authorization` header. Every endpoint is tenant-scoped — you can only operate on numbers and trunks your tenant owns.

## Base URL

```
https://voice-api.edesy.in/v1
```

## Credentials

Authenticate as the owning tenant with **either** of the following:

Generate and manage your keys in the portal at **[voice-app.edesy.in](https://voice-app.edesy.in/)**.

**Tenant API key** (recommended for server-to-server calls). Keys start with the prefix `vp_`:

```
Authorization: Bearer vp_your_api_key_here
```

**Session JWT** — a bearer token issued to a logged-in session:

```
Authorization: Bearer <jwt>
```

Treat your API key like a password — store it in an environment variable and never commit it to source control.

## Tenant scoping

Numbers, carriers, gateways, and applications are all bound to the tenant identified by the token. A number can only be inspected or modified by the tenant that owns it — requests for a resource your tenant does not own return `404 not_found`, not an authorization error, so ownership is never leaked.

A missing or invalid token returns `401`.

## Example

```bash
curl -H "Authorization: Bearer vp_YOUR_API_KEY" \
  https://voice-api.edesy.in/v1/phone-numbers
```

## Next

- [Quick Start](https://edesy.in/docs/sip-trunk-for-ai-voice-agents/getting-started/quick-start)
- [Error Codes](https://edesy.in/docs/sip-trunk-for-ai-voice-agents/api-reference/errors)