Skip to content
Wire2AirWire2Air
Wire2AirWire2Air
Log inBook a demoFree trial

Loading the index…

Authentication

The three Wire2Air credentials (REST API key, user ID with password and VASID, and app key), which endpoint takes which, and how to keep them safe.

Last updated

Wire2Air uses three kinds of credentials. Which one you send depends on the endpoint, not on your account type.

CredentialSent asUsed by
REST API keyapikey request headerEvery REST API v1 endpoint
User ID, password and VASIDRequest parameters USERID, PASSWORD, VASIDHTTP API: send SMS, send MMS, credit balance, keyword lookup, keyword register. Keyword credits takes user ID and password only
App keyRequest parameter APPKEYHTTP API: carrier lookup, subscribe user, send invitation

REST API key

Create a key in the dashboard under Manage Account → Manage API Keys (step by step). Send it in the apikey header of every request:

cURL
curl "https://msgapi.wire2air.com/rest/v1/message" \
  -H "apikey: YOUR_API_KEY" \
  --data-urlencode "to=12121234567" \
  --data-urlencode "from=27126" \
  --data-urlencode "text=Test message"

A missing or wrong key returns HTTP 401 Unauthorized.

Query-string keys

The previous docs also allowed the key as an apikey query parameter (…/rest/v1/message?apikey=YOUR_API_KEY), and one example used authkey instead.

User ID, password and VASID

The legacy HTTP API takes your account login as request parameters:

  • USERID: your Wire2Air user ID.
  • PASSWORD: your Wire2Air password.
  • VASID: an account identifier shown under Manage Account → API Information.

Send them in the body of a POST (as application/x-www-form-urlencoded), never in a GET query string: a URL with a password in it ends up in logs. Every HTTP API example in these docs uses POST.

A wrong login returns a plain-text error. The wording varies by endpoint: ERR: 301: Failed authentication on send SMS, send MMS and credit balance, Err:300:Invalid Userid or password on the keyword endpoints. See Errors.

App key

Some HTTP API endpoints take an app key in the APPKEY parameter instead of a login. The carrier lookup page says it can be found under Manage Account → API Information.

Keep credentials safe

  • Call the APIs from your server only. Never ship a key or password in browser JavaScript or a mobile app.
  • Load credentials from environment variables or a secret store, not from source code.
  • Use https:// URLs. A few endpoints are documented over plain http:// only; their pages say so.