Get your key in the app under Developers → API key. An account holds one key at a time: generating a new one revokes the old one immediately, so replacing the key is how you rotate it. You can copy the key again later from the same page — we keep an encrypted copy — so a lost key does not mean a new one; a leaked one does, so replace it there. Keep the key server-side, never in a browser or a mobile app.
Sending the key
Authorization: Bearer wab_live_0123456789abcdef0123456789abcdefKeys start with wab_live_. Keep them server-side: a key in a browser or a mobile app can be extracted and used to send from your number at your cost.
When authentication fails
| HTTP | code | Meaning |
|---|---|---|
| 401 | invalid_api_key | The Authorization header is missing, malformed, unknown or revoked. |
A revoked key fails immediately on its next request; there is no grace period.