Your credentials
Account SID is a unique identifier for your mycpaas account. It always starts with the prefixAC and is safe to include in logs and application configuration — it is not secret on its own.
Auth Token is the secret key paired with your Account SID. It acts as a password: anyone who has it can make API requests on your behalf. Rotate it from the Dashboard if you ever suspect it has been exposed.
Where to find them
- eGet you credentials at Credentials.
Passing credentials
- curl -u flag
The simplest way to authenticate is with curl’s curl automatically Base64-encodes the credentials and adds the
-u flag. Pass your Account SID and Auth Token separated by a colon:Authorization header for you.HTTP 401 errors
A401 Unauthorized response means the API could not authenticate your request. The table below covers the most common causes and how to fix them.
| Cause | How to fix |
|---|---|
| Wrong Account SID | Confirm the SID starts with AC and matches what’s shown in the Dashboard |
| Wrong Auth Token | Re-copy the Auth Token from the Dashboard; make sure there are no extra spaces |
| Credentials not encoded correctly | If constructing the header manually, verify the Base64 encoding includes the colon separator between SID and token |
| Auth Token recently rotated | Update your application or environment variables with the new token |
| Using another provider’s credentials | mycpaas credentials are separate from Twilio and SignalWire — generate new credentials from the Dashboard |

