Authentication

eSMS uses a centralized authentication service at auth.esmsafrica.io. All products share the same account.

Single sign-on (SSO)

When you log in to any eSMS product, a secure cookie is set on .esmsafrica.io. This means:

• Log in once, and you're authenticated across all products
• No need to create separate accounts for Mail, SMS, and SMPP
• Logging out of one product logs you out of all

Authentication methods

API keys (eSMS Mail)

API keys are used to authenticate requests to the eSMS Mail API. They start with esms_k_ and are passed in the Authorization header:

Authorization: Bearer esms_k_your_api_key

Create API keys at send.esmsafrica.io → Settings → API Keys.

API keys support scoped permissions — you can create read-only keys or keys limited to specific operations.

HTTP API keys (SMS Platform)

The SMS Platform uses HTTP API keys for programmatic access. These are different from Mail API keys and are managed at app.esmsafrica.io.

Authorization: Bearer your_http_api_key

SMTP credentials

For sending emails via SMTP (instead of the REST API), create SMTP credentials at send.esmsafrica.io → Settings → SMTP.

SMTP settings:

JWT tokens

The eSMS Auth API issues JWT access tokens and refresh tokens. These are used by the web dashboards and can also be used for API access:

# Login
curl -X POST https://auth.esmsafrica.io/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your_password"}'

The response includes access_token and refresh_token. Access tokens expire after 7 days. Use the refresh token to obtain a new access token without re-authenticating.

Rate limits

See Billing for plan details.