Authentication
How to authenticate with the Ersaal API using Bearer tokens
The Ersaal API uses Bearer token authentication. Include your token in the Authorization header on every request.
Authorization: Bearer YOUR_API_TOKENGetting your token
- Log in to sms.lamah.com
- Go to Projects and open a project
- Add your server IP to the allowed list
- Copy the API token from project details
Security best practices
- Store tokens in environment variables, never in source code
- Use one token per project — avoid sharing tokens across projects
- Rotate tokens periodically from the dashboard
- Monitor API usage for unexpected activity
Authentication errors
| Status | Code | Meaning |
|---|---|---|
401 | UNAUTHORIZED | Token is missing, invalid, or expired |
403 | ACCESS_DENIED | Token is valid but lacks permission for this action |
If you receive a 401, verify the token format includes the Bearer prefix and that there are no extra spaces or newlines.
Testing your token
Call the project details endpoint to confirm authentication is working:
curl https://sms.lamah.com/api/project/details \
-H "Authorization: Bearer YOUR_API_TOKEN"A 200 response means your token is valid.