Keys and permissions

Authorization: Bearer wsk_live_…
# Or:
X-API-Key: wsk_live_…

Use one header. If you send both, they must contain the same key. Keys work with /api/v1 and /api/mcp. OAuth continues to work with the existing MCP endpoint. Keep secrets in server-side credentials; never put them in browser code or public repositories.

• Read chats and messages (required)

  whatsapp.messages:read

• Send messages

  whatsapp.messages:send

• Files, reactions, edits and polls

  whatsapp.messages:manage

• Manage groups

  whatsapp.groups:manage

• Manage templates

  whatsapp.templates:manage

• Run campaigns

  whatsapp.campaigns:manage

• Change saved chats and filters

  whatsapp.settings:manage

• Manage webhooks

  whatsapp.webhooks:manage

General message scopes cover both connected channels. The existing Business-only OAuth scope remains restricted to the Business connector. Group administration and webhook management need their own permissions. Campaign sends also require send permission and an enabled campaign worker.

Only the account owner can manage keys in the dashboard. A maximum of ten active keys is allowed. The full key is shown once and stored only as a SHA-256 hash. You can rename it, reduce or expand permissions, and revoke it; revocation takes effect on the next request. Creating, editing and revoking keys is audited. The Max plan and inbox storage consent are checked on every request. If the account leaves Max, its keys get a plan_required error and its webhooks pause until you resume them after upgrading.