Authentication

Every request to the Smarty.tel API must be authenticated. Two methods are supported: API Key/Secret (recommended for server-to-server integrations) and session cookie (used by the Smarty.tel web app itself, and suitable for browser-based integrations that log in on behalf of a user).

API Key / Secret (recommended)

Each user can generate an API Key and API Secret pair from their user settings in Smarty.tel (User Settings → API Access → Generate Keys). The secret is shown only once — store it securely.

Send both values in the Authorization header using the token scheme:

Authorization: token <api_key>:<api_secret>

Example:

curl -X GET "https://app.smarty.tel/api/resource/Customer" \
  -H "Authorization: token 3f7a9c1e2b8d4f6:9e2a7d4c1b6f8e3a"

Requests made with an API key run with the permissions of the user the key belongs to — the same role- and permission-based access control that applies inside the app also applies to the API.

Session (cookie) authentication

If your integration logs a user in interactively (for example, a browser extension or a companion web app), you can authenticate via the standard login endpoint and reuse the resulting session cookie for subsequent calls.

curl -X POST "https://app.smarty.tel/api/method/login" \
  -H "Content-Type: application/json" \
  -d '{"usr": "user@example.com", "pwd": "your-password"}' \
  -c cookies.txt

curl -X GET "https://app.smarty.tel/api/resource/Ticket" \
  -b cookies.txt

Session auth is subject to CSRF protection on state-changing requests (POST, PUT, DELETE). Include the X-Frappe-CSRF-Token header, obtained from frappe.csrf_token in the boot response, when using this method from a browser context.

Choosing a method

	API Key/Secret	Session cookie
Best for	Server-to-server integrations	Browser-based apps, interactive logins
Expires	Never (until revoked)	On logout / session timeout
CSRF protection required	No	Yes, for write requests

For most external integrations connecting to app.smarty.tel, API Key/Secret is the recommended approach.

Revoking access

To revoke a compromised or unused key, delete it from User Settings → API Access and generate a new pair. Revoking a key takes effect immediately across all endpoints.

Next: Resource (Document) API.