Authentication

All API requests to Tegasms require authentication using an API key. This guide explains how to generate your key and use it to authenticate your requests.

Generate your API key

To get started with the Tegasms API, you need to generate an API key from your account dashboard.

Log in to https://sms.tegasms.co.tz
Navigate to Profile > My Account
Click on API key
Click Generate to create a new API key
Copy your token and store it securely

warning

Keep your API key secret. Never commit it to version control, share it publicly, or expose it in client-side code. If your key is compromised, regenerate it immediately from your dashboard.

Authentication requirements

Every API request must include the following:

1. Add to request header

Include your API token in the Authorization header of every API call.

2. Use Bearer authentication format

Format your authorization header as:

Authorization: Bearer <your_api_token>

Replace <your_api_token> with the token you generated in your dashboard.

3. Send over HTTPS only

All requests must use HTTPS. HTTP requests will be strictly rejected by the API.

https://api.tegasms.co.tz/api/v1/...

Example request

Here is a complete example showing proper authentication:

curl -X POST https://api.tegasms.co.tz/api/v1/send_sms/type/single \
  -H "Authorization: Bearer your_api_token_here" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "Tegasms",
    "recipient": "25578246004",
    "message": "Hello, this is a test message"
  }'

Authentication errors

If your authentication fails, the API returns a 401 Unauthorized error:

{
  "status": "error",
  "message": "Unauthorized or non-existent Sender ID for the batch payload."
}

Common authentication issues:

Issue	Solution
Missing Authorization header	Include `Authorization: Bearer <token>` in every request
Invalid or expired token	Generate a new API key from your dashboard
Using HTTP instead of HTTPS	Ensure all requests use `https://`
Malformed Bearer format	Use exactly `Bearer <token>` with a space between them
Unauthorized Sender ID	Verify your sender ID is approved in your account settings

Best practices

Rotate your keys regularly, Generate new keys periodically and retire old ones

Use environment variables, Store your API key in environment variables, not hardcoded in your application

export TEGASMS_API_KEY="your_api_token_here"

Implement error handling, Check for 401 responses and handle authentication failures gracefully

Monitor API usage, Regularly review your API activity in the dashboard to detect unauthorized access

Use separate keys for environments, Generate different keys for development, staging, and production