> ## Documentation Index
> Fetch the complete documentation index at: https://docs.karflows.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate KarFlows API requests with bearer tokens.

KarFlows APIs use bearer tokens.

```http theme={null}
Authorization: Bearer YOUR_API_TOKEN
```

Tokens are product-specific:

| Token prefix | Product               |
| ------------ | --------------------- |
| `kfsms_`     | SMS REST API          |
| `kfotp_`     | OTP API               |
| `kfmsg_`     | Unified Messaging API |
| JWT token    | WhatsApp QR REST API  |

## Token safety

Keep API tokens on your server. Do not expose them in frontend JavaScript, mobile apps, or public repositories.

## Disabled tokens

If an administrator disables a service, KarFlows immediately rejects public requests for that token.

Common disabled responses:

```json theme={null}
{
  "success": false,
  "message": "SMS API is disabled by the account administrator"
}
```

```json theme={null}
{
  "success": false,
  "message": "Plan has expired"
}
```

## Passing tokens in tests

Bearer headers are recommended. Some legacy endpoints also accept `token`, `apiKey`, or `api_key`, but new integrations should use the `Authorization` header.