Authentication

Base URL: https://your-domain.com

The Zal Pro API is protected by three layers of access control. A request must pass all enabled layers before it reaches an endpoint.

1. API must be enabled globally.
2. HTTP Basic Authentication with the configured API username & password.
3. IP Whitelist (optional) — only listed IPs may call the API.

---

Step 1 — Enable the API

1. Log in to Zal Pro as an admin.
2. Open Settings → Others API & Server Settings.
3. Turn API Status to Enabled.
4. Set an API Username and API Password. These are your Basic Auth credentials.
5. (Optional) Enable IP Whitelist and enter the comma-separated list of IP addresses allowed to access the API.

If the API is disabled

Any request returns HTTP 403 with the body Zal Pro API Unauthorized Request.

---

Step 2 — Send Basic Auth on every request

Zal Pro uses standard HTTP Basic Authentication. Combine your API username and password as username:password, Base64-encode the result, and send it in the Authorization header:

Authorization: Basic base64(api_username:api_password)

Request Headers

Header	Value	Required
Authorization	Basic {credentials}	Yes
Accept	application/json	Yes
Content-Type	application/x-www-form-urlencoded	Yes (POST)

TIP

Almost every HTTP client can build the Basic Auth header for you — you rarely need to Base64-encode by hand.

• cURL: -u "username:password"
• Postman: Authorization tab → Type Basic Auth
• Guzzle / Axios / etc.: an auth: [username, password] option

cURL Example

curl -X GET "https://your-domain.com/api/user/users" \
  -u "your_api_username:your_api_password" \
  -H "Accept: application/json"

Failure

If the credentials are missing or wrong, the API responds with 401 Unauthorized.

---

Step 3 — IP Whitelist (optional)

When IP Whitelist is enabled in Settings, Zal Pro compares the caller's IP address against the configured list. A request from an IP that is not on the list is rejected:

HTTP/1.1 403 Forbidden

Zal Pro API Request From Unauthorized IP Address

INFO

If the whitelist is enabled but empty, all requests are rejected. Add at least one IP, or disable the whitelist, to allow access.

---

Authentication Checklist

Check	Requirement
API enabled	Settings → API Status = Enabled
Credentials set	API Username and API Password configured
Header sent	Authorization: Basic ... on every request
IP allowed	Caller IP is on the whitelist (only if whitelist is enabled)

Once all applicable checks pass, continue to the Subscribers API → or Tickets API →.