Authentication
Every request is authenticated with an organization-scoped API key sent as a Bearer token.
API keys
Create and manage keys in Settings → API (admin or owner role). A key looks like wsk_live_… and is shown once at creation — only a hash is stored, so it can never be retrieved again.
bash
curl "https://api.mywa.net/api/public/v1/me" \
-H "Authorization: Bearer wsk_live_ab12cd34…"GET /me is the cheapest way to verify a key. It returns the organization it belongs to and its scopes:
json
{
"organization": { "id": "org_…", "name": "Acme Store" },
"scopes": ["messages:send", "templates:read", "automations:write"]
}Scopes
Grant each key only what its integration needs. Requests missing a required scope return 403 missing_scope.
| Field | Type | Description |
|---|---|---|
messages:send | scope | Send messages (POST /messages). |
messages:read | scope | Read message status (GET /messages/:id). |
contacts:read | scope | List and fetch contacts. |
contacts:write | scope | Create and update contacts. |
templates:read | scope | List approved templates. |
automations:read | scope | List automations and read their runs. |
automations:write | scope | Start an automation for a contact. |
Keeping keys safe
- Use keys server-side only — never ship them in mobile apps or browser code.
- Store keys in a secrets manager or environment variable, not in source control.
- Use one key per integration so you can revoke a single one without downtime.
- Rotate by creating a new key, switching your integration over, then revoking the old one. Revocation takes effect immediately.
Leaked a key?
Revoke it right away in Settings → API. Requests using a revoked key fail with
401 invalid_api_key instantly.