Authentication

Authenticate KarFlows API requests with bearer tokens.

KarFlows APIs use bearer tokens.

Authorization: Bearer YOUR_API_TOKEN

Tokens are product-specific:

Token prefix	Product
kfsms_	SMS REST API
kfotp_	OTP API
kfmsg_	Unified Messaging API
JWT token	WhatsApp QR REST API

Token safety

Keep API tokens on your server. Do not expose them in frontend JavaScript, mobile apps, or public repositories.

Disabled tokens

If an administrator disables a service, KarFlows immediately rejects public requests for that token.

Common disabled responses:

{
  "success": false,
  "message": "SMS API is disabled by the account administrator"
}

{
  "success": false,
  "message": "Plan has expired"
}

Passing tokens in tests

Bearer headers are recommended. Some legacy endpoints also accept token, apiKey, or api_key, but new integrations should use the Authorization header.