Sinch Agentic Tools
Sinch SDKs
Sinch CLI & Functions
For credentials specific to the Voice or Verification APIs, see the Product-specific credentials section at the end of this page.
You create and manage all of these credentials yourself in the Sinch Build Dashboard.
This is the modern, recommended path and the ones most Sinch APIs use.
Create an access key in your project. You get a Key ID and a Key Secret. See Access keys.
Exchange the key for a short-lived OAuth2 bearer token using the client credentials grant. See OAuth2 access tokens.
Send the token on every request:
curl https://numbers.api.sinch.com/v1/projects/YOUR_project_id/availableNumbers \ -H "Authorization: Bearer YOUR_access_token"
Tokens are short-lived. Cache a token and reuse it until it expires rather than requesting a new one per call. Details in OAuth2 access tokens.
The following authentication methods apply to specific Sinch products.
The Voice API and the classic Verification API authenticate at the application level using an application key and application secret. They support HTTP Basic authentication and a signed-request scheme for higher security.
curl https://calling.api.sinch.com/calling/v1/callouts \
-u "YOUR_application_key:YOUR_application_secret" \
-H "Content-Type: application/json"| Placeholder | Description |
|---|---|
YOUR_application_key | Your app's key, found in the dashboard under the app's settings. |
YOUR_application_secret | Your app's secret. Treat it like a password. |
Whichever method you use, the same rules apply:
- Never commit secrets to source control or expose them in client-side code.
- Store secrets in a secrets manager or environment variables.
- Rotate credentials periodically and immediately if one may be exposed.
- Scope access keys to the narrowest project that needs them.
See Access keys for rotation and storage guidance.
