Sinch · Authentication Profile

Sinch Authentication

Authentication

Sinch secures its APIs with apiKey, http, and oauth2 across 8 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CommunicationsMessagingSMSVoiceVerificationCPaaSTelecommunicationsWhatsApp
Methods: apiKey, http, oauth2 Schemes: 8 OAuth flows: clientCredentials API key in: header

Security Schemes

BasicAuth http
scheme: basic
OAuth2 oauth2
· flows: clientCredentials
bearerAuth http
scheme: bearer
hmacAuth http
scheme: hmac
hmacAuth apiKey
· in: header (X-Sinch-Signature)
ApiKey apiKey
· in: header (x-api-key)
Application apiKey
· in: header (Authentication)
Signed apiKey
· in: header (Authorization)

Source

Authentication Profile

Raw ↑
generated: '2026-10-08'
method: derived
source: openapi/sinch-10dlc-registration-api-openapi.yml, openapi/sinch-access-keys-api-openapi.yml,
  openapi/sinch-access-keys-legacy-api-openapi.yml, openapi/sinch-batches-api-openapi.yml, openapi/sinch-brands-api-openapi.yml,
  openapi/sinch-chatlayer-analytics-api-openapi.yml, openapi/sinch-compliance-brands-api-openapi.yml,
  openapi/sinch-conversation-api-openapi.yml, openapi/sinch-delivery-reports-api-openapi.yml,
  openapi/sinch-elastic-sip-trunking-api-openapi.yml, openapi/sinch-fax-api-openapi.yml, openapi/sinch-groups-api-openapi.yml
  ...
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
schemes:
- name: BasicAuth
  type: http
  scheme: basic
  description: Our basic security works with any project. Simply use the client_id and client_secret
    that were displayed when you created your access key through the dashboard in the [Access
    keys section](https://dashboard.sinch.com/settings/access-keys).
  sources:
  - openapi/sinch-10dlc-registration-api-openapi.yml
  - openapi/sinch-access-keys-api-openapi.yml
  - openapi/sinch-access-keys-legacy-api-openapi.yml
  - openapi/sinch-chatlayer-analytics-api-openapi.yml
  - openapi/sinch-conversation-api-openapi.yml
  - openapi/sinch-elastic-sip-trunking-api-openapi.yml
  - openapi/sinch-fax-api-openapi.yml
  - openapi/sinch-imported-numbers-hosting-orders-api-openapi.yml
  - openapi/sinch-number-lookup-api-openapi.yml
  - openapi/sinch-numbers-api-openapi.yml
  - openapi/sinch-porting-api-openapi.yml
  - openapi/sinch-provisioning-api-openapi.yml
  - openapi/sinch-subprojects-api-openapi.yml
  - openapi/sinch-template-management-api-openapi.yml
  - openapi/sinch-verification-api-openapi.yml
  - openapi/sinch-voice-api-openapi.yml
  - openapi/sinch-voice-api-v2-openapi.yml
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.sinch.com/oauth2/token
    scopes: 0
  description: This is the recommended way to access our APIs in production.
  sources:
  - openapi/sinch-10dlc-registration-api-openapi.yml
  - openapi/sinch-access-keys-api-openapi.yml
  - openapi/sinch-access-keys-legacy-api-openapi.yml
  - openapi/sinch-brands-api-openapi.yml
  - openapi/sinch-compliance-brands-api-openapi.yml
  - openapi/sinch-conversation-api-openapi.yml
  - openapi/sinch-elastic-sip-trunking-api-openapi.yml
  - openapi/sinch-fax-api-openapi.yml
  - openapi/sinch-imported-numbers-hosting-orders-api-openapi.yml
  - openapi/sinch-number-lookup-api-openapi.yml
  - openapi/sinch-numbers-api-openapi.yml
  - openapi/sinch-porting-api-openapi.yml
  - openapi/sinch-provisioning-api-openapi.yml
  - openapi/sinch-subprojects-api-openapi.yml
  - openapi/sinch-template-management-api-openapi.yml
  - openapi/sinch-us-shortcode-campaigns-api-openapi.yml
  - openapi/sinch-voice-api-v2-openapi.yml
- name: bearerAuth
  type: http
  scheme: bearer
  description: API token sent in the Authorization header preceded by Bearer.
  sources:
  - openapi/sinch-batches-api-openapi.yml
  - openapi/sinch-delivery-reports-api-openapi.yml
  - openapi/sinch-groups-api-openapi.yml
  - openapi/sinch-inbounds-api-openapi.yml
  - openapi/sinch-provisioning-api-openapi.yml
- name: hmacAuth
  type: http
  scheme: hmac
  description: Used for hashing callbacks. Please refer to the callback-configuration endpoints
    for more information.
  sources:
  - openapi/sinch-brands-api-openapi.yml
  - openapi/sinch-us-shortcode-campaigns-api-openapi.yml
- name: hmacAuth
  type: apiKey
  in: header
  parameter: X-Sinch-Signature
  description: HMAC-SHA256 signature used to authenticate webhook deliveries. The signature
    is computed over the request body using the project's HMAC secret and sent in the X-Sinch-Signature
    header. Please refer to the Brand Callback endpoints for more information.
  sources:
  - openapi/sinch-compliance-brands-api-openapi.yml
- name: ApiKey
  type: apiKey
  in: header
  parameter: x-api-key
  sources:
  - openapi/sinch-mms-api-openapi.yml
- name: Application
  type: apiKey
  in: header
  parameter: Authentication
  description: For more information about application request signing authentication, see [Request
    Signing](https://developers.sinch.com/docs/verification/api-reference/authentication/application-signed-request).
  sources:
  - openapi/sinch-verification-api-openapi.yml
- name: Signed
  type: apiKey
  in: header
  parameter: Authorization
  description: For more information about signed request authentication, see [Request Signing](https://developers.sinch.com/docs/voice/api-reference/authentication/signed-request).
  sources:
  - openapi/sinch-voice-api-openapi.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact
curl "https://apis.io/api/v1/security/sinch-authentication"
All security posture
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.