Authentication

All API endpoints require authentication via a Bearer token sent in the Authorization header.

Obtaining Your API Token

1. Log in to your VTU API dashboard
2. Navigate to Developer Settings → API Access
3. Click Generate API Token
4. Copy and store the token securely — it will only be shown once

Security Warning: Treat your API token like a password. Never share it publicly, commit it to version control, or expose it in client-side code.

Request Headers

Every API request must include these headers:

{
  "Accept": "application/json",
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN"
}

Example Request

curl -X POST https://example.com/api/data \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{"mobile_number": "08101234567", "plan": "SME_1GB", "network": 1}'

Token Management

Action	Description
Generate	Creates a new API token (invalidates previous token)
Regenerate	Rotates your token — old token stops working immediately

IP & URL Whitelisting

For additional security, you can restrict API access:

• IP Whitelist — Only allow requests from specific IP addresses (supports wildcards like 192.168.1.*)
• URL Whitelist — Only allow requests from specific domain origins (supports subdomain wildcards)

Configure whitelisting from Developer Settings → API Security in your dashboard.

Note: If whitelisting is enabled but the whitelist is empty, all requests are allowed (fail-open behavior).

Authentication Errors

Status Code	Meaning
401	Missing or invalid API token
403	Token valid but IP/URL not whitelisted