---
title: "Authentication"
description: "Create API keys and authenticate your integration with X-Api-Key."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.wazapin.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Use `X-Api-Key` as the primary credential for server-to-server API integration.

```http
GET /v1/health HTTP/1.1
Host: api.wazapin.com
X-Api-Key: YOUR_API_KEY
Accept: application/json
```

:::tip
**API Key is the primary auth method.** Use `X-Api-Key` for all server-to-server integrations. Bearer token (`Authorization: Bearer ...`) is only for session-based dashboard flows — don't use it for API calls.
:::

## Get your API key

1. Sign in to [app.wazapin.com](https://app.wazapin.com).
2. Open organization **Settings → API keys** (or Developer settings).
3. Create a key with the permissions your integration needs.
4. Store the secret once; it is not shown again in full.

Programmatic key management (requires an authenticated session or org context):

- `POST /v1/api-keys`
- `GET /v1/api-keys`
- `DELETE /v1/api-keys/{keyID}`

## Verify your key

Use a read-only call that does not change data. **Health** does not require authentication; **List channels** confirms your key works.

### Health (no key)

```bash
curl -sS "https://api.wazapin.com/v1/health"
```
### Channels (with key)

```bash
curl -sS "https://api.wazapin.com/v1/channels" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"
```
### fetch

```javascript
const res = await fetch("https://api.wazapin.com/v1/channels", {
  headers: {
"X-Api-Key": process.env.WAZAPIN_API_KEY,
Accept: "application/json",
  },
});
console.log(res.status, await res.json());
```
### requests

```python
import os
import requests

r = requests.get(
"https://api.wazapin.com/v1/channels",
headers={
    "X-Api-Key": os.environ["WAZAPIN_API_KEY"],
    "Accept": "application/json",
},
timeout=30,
)
print(r.status_code, r.json())
```

### Success response

```json 200 OK
{
  "data": [
{
  "id": "wzp_abc123",
  "platform": "whatsapp_official",
  "status": "connected"
}
  ]
}
```

Field names in list responses follow the live API schema; use this call to confirm auth during setup.

### Invalid key (`401`)

```json 401 Unauthorized
{
  "title": "Unauthorized",
  "status": 401,
  "detail": "invalid or missing API key"
}
```

See [Error handling](/api/errors) and [Error codes](/api/error-codes) for other statuses.

## Optional: bearer token

Bearer token is supported for session-based login flows (for example dashboard or `POST /v1/auth/login`). Prefer `X-Api-Key` for integrations.

## Security

- Store keys in a secret manager, not in client-side code.
- Rotate keys if you suspect leakage.
- Scope keys to minimum required permissions.

:::warning
Treat API keys like passwords. Revoke and replace compromised credentials immediately.
:::

## Next steps

- [Connect your channel](/getting-started/connect-channel)
- [Quickstart](/getting-started/quickstart)
- [API playground](/api/playground-guide)

## Example request

Source: https://docs.wazapin.id/api/authentication/index.mdx