Every Voice API request must be authenticated. Use a Bearer API key (Authorization: Bearer sk_...) for new integrations. If you are porting Twilio code, you can instead use HTTP Basic auth with your Account SID as the username and your Auth Token as the password. Both resolve to the same workspace and permissions.
Option 1: Bearer API key (recommended)#
Authorization: Bearer sk_your_api_key_here
The header X-API-Key: sk_your_api_key_here is also accepted when you cannot set Authorization.
Create and delete keys on the API Keys page of voice-app.edesy.in or with POST/v1/api-keys. A key starts with sk_. The full key is shown only once, when you create it; afterwards only its prefix is visible. You can give a key an optional expiry date.
curl https://voice-api.edesy.in/v1/calls \
-H "Authorization: Bearer $EDESY_KEY"
Option 2: Basic auth with Account SID and Auth Token#
curl -u "$ACCOUNT_SID:$AUTH_TOKEN" https://voice-api.edesy.in/v1/calls
| Credential | What it is | Where to find it |
|---|---|---|
| Account SID | Your workspace ID | Credentials card on the portal dashboard |
| Auth Token | A secret tied to the workspace | Same card; you can regenerate it there |
Regenerating the Auth Token stops the old one working immediately, so update your servers first. The token can only be viewed or regenerated from a signed-in dashboard session, never with an API key.
Basic auth also accepts an API key as the password (the username is ignored): curl -u "x:$EDESY_KEY" ....
Account-scoped paths#
Twilio code puts the Account SID in the path. Those paths work here too, for example POST/v1/Accounts/{AccountSid}/Calls. The SID in the path must match the workspace your credentials belong to, otherwise the request returns 403. Both the bare workspace ID and an AC_ prefixed form are accepted. See Migrate from Twilio.
Workspaces#
A key or Auth Token belongs to one workspace. Calls, numbers and wallet balance are scoped to that workspace. See Workspaces, Team and API Keys.
Keep credentials safe#
- Keep keys in environment variables on your server. Never ship them in a web page or mobile app; call your own backend, which calls Edesy.
- Use one key per service so you can revoke one without touching the rest.
- Requests with a missing or invalid credential return
401with codeUNAUTHORIZED.