Sinch · Authentication Profile
Sinch Authentication
Authentication
Sinch secures its APIs with apiKey, http, and oauth2 across 8 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).
CommunicationsMessagingSMSVoiceVerificationCPaaSTelecommunicationsWhatsApp
Methods: apiKey, http, oauth2
Schemes: 8
OAuth flows: clientCredentials
API key in: header
Security Schemes
BasicAuth http
scheme: basic
OAuth2 oauth2
· flows: clientCredentials
bearerAuth http
scheme: bearer
hmacAuth http
scheme: hmac
hmacAuth apiKey
· in: header (X-Sinch-Signature)
ApiKey apiKey
· in: header (x-api-key)
Application apiKey
· in: header (Authentication)
Signed apiKey
· in: header (Authorization)
Source
Authentication Profile
generated: '2026-10-08'
method: derived
source: openapi/sinch-10dlc-registration-api-openapi.yml, openapi/sinch-access-keys-api-openapi.yml,
openapi/sinch-access-keys-legacy-api-openapi.yml, openapi/sinch-batches-api-openapi.yml, openapi/sinch-brands-api-openapi.yml,
openapi/sinch-chatlayer-analytics-api-openapi.yml, openapi/sinch-compliance-brands-api-openapi.yml,
openapi/sinch-conversation-api-openapi.yml, openapi/sinch-delivery-reports-api-openapi.yml,
openapi/sinch-elastic-sip-trunking-api-openapi.yml, openapi/sinch-fax-api-openapi.yml, openapi/sinch-groups-api-openapi.yml
...
summary:
types:
- apiKey
- http
- oauth2
api_key_in:
- header
oauth2_flows:
- clientCredentials
schemes:
- name: BasicAuth
type: http
scheme: basic
description: Our basic security works with any project. Simply use the client_id and client_secret
that were displayed when you created your access key through the dashboard in the [Access
keys section](https://dashboard.sinch.com/settings/access-keys).
sources:
- openapi/sinch-10dlc-registration-api-openapi.yml
- openapi/sinch-access-keys-api-openapi.yml
- openapi/sinch-access-keys-legacy-api-openapi.yml
- openapi/sinch-chatlayer-analytics-api-openapi.yml
- openapi/sinch-conversation-api-openapi.yml
- openapi/sinch-elastic-sip-trunking-api-openapi.yml
- openapi/sinch-fax-api-openapi.yml
- openapi/sinch-imported-numbers-hosting-orders-api-openapi.yml
- openapi/sinch-number-lookup-api-openapi.yml
- openapi/sinch-numbers-api-openapi.yml
- openapi/sinch-porting-api-openapi.yml
- openapi/sinch-provisioning-api-openapi.yml
- openapi/sinch-subprojects-api-openapi.yml
- openapi/sinch-template-management-api-openapi.yml
- openapi/sinch-verification-api-openapi.yml
- openapi/sinch-voice-api-openapi.yml
- openapi/sinch-voice-api-v2-openapi.yml
- name: OAuth2
type: oauth2
flows:
- flow: clientCredentials
tokenUrl: https://auth.sinch.com/oauth2/token
scopes: 0
description: This is the recommended way to access our APIs in production.
sources:
- openapi/sinch-10dlc-registration-api-openapi.yml
- openapi/sinch-access-keys-api-openapi.yml
- openapi/sinch-access-keys-legacy-api-openapi.yml
- openapi/sinch-brands-api-openapi.yml
- openapi/sinch-compliance-brands-api-openapi.yml
- openapi/sinch-conversation-api-openapi.yml
- openapi/sinch-elastic-sip-trunking-api-openapi.yml
- openapi/sinch-fax-api-openapi.yml
- openapi/sinch-imported-numbers-hosting-orders-api-openapi.yml
- openapi/sinch-number-lookup-api-openapi.yml
- openapi/sinch-numbers-api-openapi.yml
- openapi/sinch-porting-api-openapi.yml
- openapi/sinch-provisioning-api-openapi.yml
- openapi/sinch-subprojects-api-openapi.yml
- openapi/sinch-template-management-api-openapi.yml
- openapi/sinch-us-shortcode-campaigns-api-openapi.yml
- openapi/sinch-voice-api-v2-openapi.yml
- name: bearerAuth
type: http
scheme: bearer
description: API token sent in the Authorization header preceded by Bearer.
sources:
- openapi/sinch-batches-api-openapi.yml
- openapi/sinch-delivery-reports-api-openapi.yml
- openapi/sinch-groups-api-openapi.yml
- openapi/sinch-inbounds-api-openapi.yml
- openapi/sinch-provisioning-api-openapi.yml
- name: hmacAuth
type: http
scheme: hmac
description: Used for hashing callbacks. Please refer to the callback-configuration endpoints
for more information.
sources:
- openapi/sinch-brands-api-openapi.yml
- openapi/sinch-us-shortcode-campaigns-api-openapi.yml
- name: hmacAuth
type: apiKey
in: header
parameter: X-Sinch-Signature
description: HMAC-SHA256 signature used to authenticate webhook deliveries. The signature
is computed over the request body using the project's HMAC secret and sent in the X-Sinch-Signature
header. Please refer to the Brand Callback endpoints for more information.
sources:
- openapi/sinch-compliance-brands-api-openapi.yml
- name: ApiKey
type: apiKey
in: header
parameter: x-api-key
sources:
- openapi/sinch-mms-api-openapi.yml
- name: Application
type: apiKey
in: header
parameter: Authentication
description: For more information about application request signing authentication, see [Request
Signing](https://developers.sinch.com/docs/verification/api-reference/authentication/application-signed-request).
sources:
- openapi/sinch-verification-api-openapi.yml
- name: Signed
type: apiKey
in: header
parameter: Authorization
description: For more information about signed request authentication, see [Request Signing](https://developers.sinch.com/docs/voice/api-reference/authentication/signed-request).
sources:
- openapi/sinch-voice-api-openapi.yml
Work with this as data
Every security artifact here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for security posture
4 MCP tools reach this
find_securityBrowse and filter every security artifact in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This security artifact
curl "https://apis.io/api/v1/security/sinch-authentication"
All security posture
curl "https://apis.io/api/v1/security?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.