Authentication
Use the right credentials for each A1ROUTES service.
Number Lookup
Pass your main SIP account API key in the api_key query parameter. The lookup examples read this key from an environment variable. Treat the complete request URL as sensitive and redact it in application and proxy logs.
BusinessPhoneSystem
Use the A1PBX API key assigned to your integration. On deployments with header authentication enabled, send Authorization: Basic YOUR_A1PBX_API_KEY.
This interface uses the literal API key after Basic. Do not substitute a Bearer header or automatically encode a username/password pair. Confirm this header format with A1ROUTES for your deployment before integrating.
Older integrations may use the key query parameter. Ask support to confirm compatibility before changing an existing integration. The main SIP key is not interchangeable with the A1PBX key.
Protect your key
Keep keys on your server in environment variables or a secrets manager. Do not embed them in browser code, repository files, shared URLs, or analytics. Use HTTPS with certificate verification enabled.
Access is scoped to your account
The API key determines which operations and records you can access. Knowing a call or voicemail identifier does not grant access to it. Ask support for the smallest set of permissions needed by your integration.