Infobip Authentication

generated: '2026-10-08'
method: searched
source: https://www.infobip.com/docs/essentials/api-essentials/api-authentication (read as .md twin) + openapi/_original/infobip-platform-full-openapi.json components.securitySchemes (version 3.245.1)
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
schemes:
- name: APIKeyHeader
  type: apiKey
  in: header
  parameter: Authorization
  description: 'This is the most secure authorization type and the one with the most flexibility.


    API keys can be generated by calling the dedicated API method. Furthermore, API keys can have a limited scope and cover only some API methods. Lastly, they can

    be revoked at any time. This range of possibilities makes API keys well suited for separating the API access rights across multiple applications or use cases'
  sources:
  - openapi/infobip-ai-hub-api-openapi.yml
  - openapi/infobip-channels-api-openapi.yml
  - openapi/infobip-connectivity-api-openapi.yml
  - openapi/infobip-customer-engagement-api-openapi.yml
  - openapi/infobip-platform-api-openapi.yml
  - openapi/infobip-tools-api-openapi.yml
- name: Basic
  type: http
  scheme: basic
  description: 'Basic authorization type can be used in situations when the API key is not available. For example, API methods for generating API keys should be authenticated

    with the Basic type.


    In this case, the credentials included in the Authorization header should be a Base64 encoded username and password combination. More formally, basic

    authentication header can be constructed in three steps:


    * Username '
  sources:
  - openapi/infobip-ai-hub-api-openapi.yml
  - openapi/infobip-channels-api-openapi.yml
  - openapi/infobip-connectivity-api-openapi.yml
  - openapi/infobip-customer-engagement-api-openapi.yml
  - openapi/infobip-platform-api-openapi.yml
  - openapi/infobip-tools-api-openapi.yml
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.infobip.com/auth/1/oauth2/token
    scopes: 0
  description: 'Similarly to the IBSSO Token authentication you can use OAuth 2.0 bearer token with Infobip serving both as resource and authorization server. You can obtain

    the access token using the client credentials grant from `auth/1/oauth2/token` endpoint. It will provide you with your access token, and its expiration period.

    You can use the token to authorize your API calls until it expires. You can find o'
  sources:
  - openapi/infobip-ai-hub-api-openapi.yml
  - openapi/infobip-channels-api-openapi.yml
  - openapi/infobip-connectivity-api-openapi.yml
  - openapi/infobip-customer-engagement-api-openapi.yml
  - openapi/infobip-platform-api-openapi.yml
  - openapi/infobip-tools-api-openapi.yml
- name: IBSSOTokenHeader
  type: apiKey
  in: header
  header: Authorization
  format: IBSSO {session-token}
  description: Session token obtained from the Create session operation (POST /auth/1/session); expires after a period of inactivity and can be terminated by the Destroy session operation. Intended for apps that must not store Infobip credentials.
  docs: https://www.infobip.com/docs/essentials/api-essentials/api-authentication#ibsso-token-header
  source: openapi securityScheme IBSSOTokenHeader
docs: https://www.infobip.com/docs/essentials/api-essentials/api-authentication
header_formats:
  APIKeyHeader: 'Authorization: App {api-key}'
  Basic: 'Authorization: Basic {base64(username:password)}'
  IBSSOTokenHeader: 'Authorization: IBSSO {session-token}'
  OAuth2: 'Authorization: Bearer {access_token}'
oauth2:
  grant: client_credentials
  token_endpoint: https://api.infobip.com/auth/1/oauth2/token
  docs: https://www.infobip.com/docs/essentials/api-essentials/api-authentication#oauth-20
  note: Infobip is both resource and authorization server; the spec describes the client-credentials grant against auth/1/oauth2/token.
scoping:
  docs: https://www.infobip.com/docs/essentials/api-essentials/api-authorization
  note: API keys and Basic credentials can be restricted to API scopes; every operation in the OpenAPI carries x-scopes listing the scopes it accepts (see scopes/infobip-scopes.yml).
error_response:
  status: 401
  docs: https://www.infobip.com/docs/essentials/api-essentials/api-authentication#errors
  example:
    requestError:
      serviceException:
        messageId: UNAUTHORIZED
        text: Invalid login details
  note: 'Verbatim from the authentication docs: "Commonly you will get the 401 Unauthorised HTTP status code in response when there is a missing or invalid username or password."'
recommended: APIKeyHeader (the docs call it the most secure authorization type and the one with the most flexibility)
docs_authorization: https://www.infobip.com/docs/essentials/api-essentials/api-authorization