Create a key in the app under Settings → API keys. The full key is shown once, when you create it; we store only a hash, so if you lose it you create a new one. You can hold several keys at once — one per system is a good habit — and revoke any of them without affecting the others.
Sending the key
Authorization: Bearer wab_live_0123456789abcdef0123456789abcdefKeys start with wab_live_. Keep them server-side: a key in a browser or a mobile app can be extracted and used to send from your number at your cost.
When authentication fails
| HTTP | code | Meaning |
|---|---|---|
| 401 | invalid_api_key | The Authorization header is missing, malformed, unknown or revoked. |
A revoked key fails immediately on its next request; there is no grace period.