Authentication

Create API keys and authenticate your integration with X-Api-Key.

Use X-Api-Key as the primary credential for server-to-server integration.

GET /v1/health HTTP/1.1
Host: api.wazapin.com
X-Api-Key: YOUR_API_KEY
Accept: application/json

Get your API key

Sign in to app.wazapin.com.
Open organization Settings → API keys (or Developer settings).
Create a key with the permissions your integration needs.
Store the secret once; it is not shown again in full.

Programmatic key management (requires an authenticated session or org context):

POST /v1/api-keys
GET /v1/api-keys
DELETE /v1/api-keys/{keyID}

Verify your key

Use a read-only call that does not change data. Health does not require authentication; List channels confirms your key works.

curl -sS "https://api.wazapin.com/v1/health"

curl -sS "https://api.wazapin.com/v1/channels" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

const res = await fetch("https://api.wazapin.com/v1/channels", {
  headers: {
    "X-Api-Key": process.env.WAZAPIN_API_KEY,
    Accept: "application/json",
  },
});
console.log(res.status, await res.json());

import os
import requests

r = requests.get(
    "https://api.wazapin.com/v1/channels",
    headers={
        "X-Api-Key": os.environ["WAZAPIN_API_KEY"],
        "Accept": "application/json",
    },
    timeout=30,
)
print(r.status_code, r.json())

Success response

{
  "data": [
    {
      "id": "wzp_abc123",
      "platform": "whatsapp_official",
      "status": "connected"
    }
  ]
}

Field names in list responses follow the live API schema; use this call to confirm auth during setup.

Invalid key (`401`)

{
  "title": "Unauthorized",
  "status": 401,
  "detail": "invalid or missing API key"
}

See Error handling and Error codes for other statuses.

Optional: bearer token

Bearer token is supported for session-based login flows (for example dashboard or POST /v1/auth/login). Prefer X-Api-Key for integrations.

Security

Store keys in a secret manager, not in client-side code.
Rotate keys if you suspect leakage.
Scope keys to minimum required permissions.