# Authentication

> Authenticate Voice API requests with a Bearer API key (sk_...) or Twilio-style Basic auth using your Account SID and Auth Token.

Source: https://edesy.in/docs/voice-api/getting-started/authentication

Every Voice API request must be authenticated. Use a Bearer API key (`Authorization: Bearer sk_...`) for new integrations. If you are porting Twilio code, you can instead use HTTP Basic auth with your Account SID as the username and your Auth Token as the password. Both resolve to the same workspace and permissions.

## Option 1: Bearer API key (recommended)

```
Authorization: Bearer sk_your_api_key_here
```

The header `X-API-Key: sk_your_api_key_here` is also accepted when you cannot set `Authorization`.

Create and delete keys on the API Keys page of [voice-app.edesy.in](https://voice-app.edesy.in) or with `POST /v1/api-keys`. A key starts with `sk_`. The full key is shown only once, when you create it; afterwards only its prefix is visible. You can give a key an optional expiry date.

```bash
curl https://voice-api.edesy.in/v1/calls \
  -H "Authorization: Bearer $EDESY_KEY"
```

## Option 2: Basic auth with Account SID and Auth Token

```bash
curl -u "$ACCOUNT_SID:$AUTH_TOKEN" https://voice-api.edesy.in/v1/calls
```

| Credential | What it is | Where to find it |
|---|---|---|
| Account SID | Your workspace ID | Credentials card on the portal dashboard |
| Auth Token | A secret tied to the workspace | Same card; you can regenerate it there |

Regenerating the Auth Token stops the old one working immediately, so update your servers first. The token can only be viewed or regenerated from a signed-in dashboard session, never with an API key.

Basic auth also accepts an API key as the password (the username is ignored): `curl -u "x:$EDESY_KEY" ...`.

## Account-scoped paths

Twilio code puts the Account SID in the path. Those paths work here too, for example `POST /v1/Accounts/{AccountSid}/Calls`. The SID in the path must match the workspace your credentials belong to, otherwise the request returns `403`. Both the bare workspace ID and an `AC_` prefixed form are accepted. See [Migrate from Twilio](https://edesy.in/docs/voice-api/guides/migrate-from-twilio).

## Workspaces

A key or Auth Token belongs to one workspace. Calls, numbers and wallet balance are scoped to that workspace. See [Workspaces, Team and API Keys](https://edesy.in/docs/voice-api/account/workspaces-team-and-api-keys).

## Keep credentials safe

- Keep keys in environment variables on your server. Never ship them in a web page or mobile app; call your own backend, which calls Edesy.
- Use one key per service so you can revoke one without touching the rest.
- Requests with a missing or invalid credential return `401` with code `UNAUTHORIZED`.