Skip to main content
Every authenticated Phonovation API request uses a bearer token. For most integrations, use a personal access token (PAT) generated in the Phonovation application. Use OAuth only when your integration needs an access-token and refresh-token lifecycle.

​
Personal access tokens

Generate and manage PATs in Phonovation developer settings. PAT values begin with phv_pat_.
1

Generate the PAT

Create the PAT once in the Phonovation application. Copy it when it is shown.
2

Store it securely

Put the PAT in a secrets manager or another protected runtime secret. Never commit it to source control or include it in logs.
3

Use it as a bearer token

Preserve the token’s casing and include it in the Authorization header:
Authenticated request
4

Rotate when needed

Replace the PAT when it expires, is revoked, or you intentionally rotate it. You do not generate a new PAT for each SMS.

​
Optional OAuth tokens

The OAuth endpoint is available for integrations that specifically need a token lifecycle:
OAuth token endpoint
Send the request as application/x-www-form-urlencoded with the OAuth client ID messaging-api.
Exchange a Phonovation username and password for an access token and refresh token. This compatibility flow must be enabled for the messaging-api client.
Obtain OAuth tokens
A successful response includes access_token, expires_in, and token_type. It can also include refresh_token and refresh_expires_in. Use the lifetimes returned by the API instead of assuming fixed values.

​
Use the token

PATs and OAuth access tokens use the same header:
Authorization header
The health endpoint is public. Campaign creation and campaign-summary requests require authentication.

​
Authentication errors

Authentication API Reference

Review the complete OAuth request and response schemas.