Create, rotate, and revoke API keys

Create a separate API key for each calling service and WhatsApp number. Every key is permanently bound to one number in its workspace. There is no unrestricted workspace-wide Developer API key.

Create a key

1. Open Settings > Developer > API keys as an Admin or Developer.
2. Select Create API key.
3. Enter a Name that identifies the service and environment.
4. Choose the WhatsApp number the key will use.
5. Select one or more permissions: messages:send, messages:read, or media:read.
6. Select Create key and copy the secret before closing the dialog.

The full wak_ secret is shown once. Store it in the calling service's secret manager. Do not place it in browser code, source control, screenshots, support tickets, or logs. If it was not saved, create a replacement or rotate the key; the existing secret cannot be revealed again.

Before testing, choose Use Developer API under Choose one inbound handler on the API keys tab for the same number. Configure callbacks separately on Webhooks. The number must be connected. Review the setup sequence and handler change because it changes who responds to inbound messages.

Edit or rotate a key

You can change a key's name or supported permissions. Changing its number requires a new key.

The Rotate action immediately invalidates the old token and shows a fresh secret once. Coordinate that change with the calling service. For an overlap while replacing credentials, create a separate replacement key, update and test the service, then revoke the old key. A built-in rotation does not provide that overlap.

Revoke access

Revoke a key when a service is retired or a secret may be exposed. Revocation stops future authentication and preserves historical audit records. Updating the service alone does not revoke an old credential.

Key scope does not bypass consent, the service window, human ownership, sender connection, or provider safety rules. See API authentication for the first read-only check and errors for failures.