Authentication

All API requests require authentication via one of the following methods.

API Key (recommended)

:::tip Recommended method API Key authentication is the simplest and most secure method. It does not require Base64 encoding and reduces the risk of exposing credentials in logs. :::

The simplest method. Add the X-Api-Key header to every request:

cURL

curl -X POST "https://lora-api.agiletelecom.com/api/message-server/sms/send" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "destination": "+393401234567",
    "sender": "MyCompany",
    "body": "Hello world"
  }'

Node.js

const response = await fetch(
  "https://lora-api.agiletelecom.com/api/message-server/sms/send",
  {
    method: "POST",
    headers: {
      "X-Api-Key": "YOUR_API_KEY",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      destination: "+393401234567",
      sender: "MyCompany",
      body: "Hello world",
    }),
  }
);

const data = await response.json();
console.log(data);

Python

import requests

response = requests.post(
    "https://lora-api.agiletelecom.com/api/message-server/sms/send",
    headers={
        "X-Api-Key": "YOUR_API_KEY",
        "Content-Type": "application/json",
    },
    json={
        "destination": "+393401234567",
        "sender": "MyCompany",
        "body": "Hello world",
    },
)

print(response.json())

PHP

$ch = curl_init();

curl_setopt_array($ch, [
    CURLOPT_URL            => "https://lora-api.agiletelecom.com/api/message-server/sms/send",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "X-Api-Key: YOUR_API_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "destination" => "+393401234567",
        "sender"      => "MyCompany",
        "body"        => "Hello world",
    ]),
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

warning

Never share your API Key in public repositories, client-side code, or insecure channels. If compromised, regenerate it immediately from the Qlara platform.

Your API Key is available in the settings section of the Qlara platform.

Basic Auth

Standard HTTP method with username and password encoded in Base64:

cURL

curl -X POST "https://lora-api.agiletelecom.com/api/message-server/sms/send" \
  -H "Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=" \
  -H "Content-Type: application/json" \
  -d '{
    "destination": "+393401234567",
    "sender": "MyCompany",
    "body": "Hello world"
  }'

Node.js

const response = await fetch(
  "https://lora-api.agiletelecom.com/api/message-server/sms/send",
  {
    method: "POST",
    headers: {
      Authorization: "Basic " + btoa("username:password"),
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      destination: "+393401234567",
      sender: "MyCompany",
      body: "Hello world",
    }),
  }
);

const data = await response.json();
console.log(data);

Python

import requests

response = requests.post(
    "https://lora-api.agiletelecom.com/api/message-server/sms/send",
    auth=("username", "password"),
    headers={
        "Content-Type": "application/json",
    },
    json={
        "destination": "+393401234567",
        "sender": "MyCompany",
        "body": "Hello world",
    },
)

print(response.json())

PHP

$ch = curl_init();

curl_setopt_array($ch, [
    CURLOPT_URL            => "https://lora-api.agiletelecom.com/api/message-server/sms/send",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_USERPWD        => "username:password",
    CURLOPT_HTTPHEADER     => [
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "destination" => "+393401234567",
        "sender"      => "MyCompany",
        "body"        => "Hello world",
    ]),
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

How to generate the Base64 value

Linux / macOS:

Generate Base64 on Linux/macOS

echo -n "username:password" | base64

Windows PowerShell:

Generate Base64 on Windows

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("username:password"))

IP Whitelist

For each account, a list of allowed IPs can be configured in the Qlara platform. If enabled, requests from unauthorized IPs receive 403 Forbidden.

Authentication flow

Authentication errors

Code	Meaning	What to do
401	Missing or invalid credentials	Verify your API Key or Basic credentials
403	Unauthorized IP or inaccessible resource	Verify the IP whitelist in the platform