Skip to main content

Authentication

Use API keys for public AfriRoute API integrations. Use account login only for authenticated console sessions, not for copy-paste server-to-server examples.

For backend integrations, create a scoped API key in the console and send it with each API request.

curl --request POST https://api.afriroute.ai/api/v1/sms/send \
  --header "Authorization: Bearer $AFRIROUTE_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "to": "+251900000000",
    "message": "Hello from AfriRoute",
    "country": "ET",
    "senderId": "AFRIROUTE"
  }'

Keep API keys on your server. Do not put live API keys in browser code, mobile apps, screenshots, public repositories, Postman exports, or client-side logs.

Create an API Key​

  1. Sign in to the AfriRoute console.
  2. Open Settings -> API Keys.
  3. Create a sandbox key first.
  4. Scope the key to only the products your integration needs.
  5. Copy the key once and store it in your secret manager.

Use separate keys for sandbox and production. Rotate keys regularly and immediately revoke any key that may have been exposed.

Server-Side Example​

const response = await fetch("https://api.afriroute.ai/api/v1/sms/send", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.AFRIROUTE_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    to: "+251900000000",
    message: "Hello from AfriRoute",
    country: "ET",
    senderId: "AFRIROUTE",
  }),
});

if (!response.ok) {
  throw new Error(`AfriRoute request failed: ${response.status}`);
}

const result = await response.json();

Console Login Boundary​

AfriRoute account login is for console and dashboard sessions. The backend route is:

curl --request POST https://api.afriroute.ai/api/v1/auth/login \
  --header "Content-Type: application/json" \
  --data '{
    "email": "[email protected]",
    "password": "YOUR_PASSWORD",
    "rememberMe": false
  }'

The response is wrapped by the AfriRoute API response envelope and may include an access token, refresh token, user, tenant, MFA state, and approval state depending on the account. Do not publish real tokens or paste JWT-like examples into docs.

For browser applications, prefer the AfriRoute-hosted console/session flow. Do not store access or refresh tokens in localStorage in public examples.

Refresh Tokens​

Refresh tokens are session credentials. Treat them like passwords:

  • Store them only in secure server-side storage or protected HTTP-only cookies.
  • Rotate refresh tokens on use.
  • Revoke sessions on logout, account compromise, or admin action.
  • Never log refresh tokens.

Webhook Authentication​

AfriRoute signs outbound webhooks. Verify signatures before processing the event.

import crypto from "node:crypto";

export function verifyAfriRouteWebhook(rawBody, signature, webhookSecret) {
  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawBody)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex")
  );
}

Use the raw request body for signature verification. Parse JSON only after the signature is valid.

Security Checklist​

  • Use HTTPS only.
  • Keep API keys and webhook secrets server-side.
  • Use least-privilege scopes for every API key.
  • Keep sandbox and production keys separate.
  • Rotate keys on a schedule and after suspected exposure.
  • Verify webhook signatures with constant-time comparison.
  • Log request IDs and failure states, not secrets or tokens.
  • Use managed AfriRoute Verify for OTP flows instead of building OTP storage yourself.