Manage API keys

Create a separate API key for each calling service and WhatsApp number. Every key is permanently bound to one number in its workspace. There is no unrestricted workspace-wide Developer API key.

Create a keyCopy Anchor Link

1. Open Settings > Developer > API keys as an Admin or Developer.
2. Select Create API key.
3. Enter a Name that identifies the service and environment.
4. Choose the WhatsApp number the key will use.
5. Select only the scopes the service needs. Read scopes cover messages, media, templates, reports, campaign results and callback settings; workspace-prefixed scopes cover shared contacts, labels and static segments. See the scope table.
6. Select Create key and copy the secret before closing the dialog.

The full wak_ secret is shown once. Store it in the calling service's secret manager. Do not place it in browser code, source control, screenshots, support tickets, or logs. If it was not saved, create a replacement or rotate the key; the existing secret cannot be revealed again.

For observation, keep Logic Flow handling and grant the appropriate read scopes. All-origin callbacks require an explicit observeAllOrigins: true opt-in; omission writes false, including on a previously opted-in callback, and never replays history. Select Use your server only when this integration should send autonomous replies. Review the setup sequence and handler change, because it changes who responds to inbound messages.

Edit or rotate a keyCopy Anchor Link

Use Edit key to change an existing key's name or explicit scopes, then save. Existing keys never gain new scopes automatically. You can grant only scopes permitted by your current workspace role and number access; campaign reads require broadcast-read authority. Workspace-prefixed scopes expose shared workspace data even though the key is number-bound. Changing its number requires a new key. Editing scopes does not change the inbound handler, grant reply authority or release human ownership.

The Rotate action immediately invalidates the old token and shows a fresh secret once. Coordinate that change with the calling service. For an overlap while replacing credentials, create a separate replacement key, update and test the service, then revoke the old key. A built-in rotation does not provide that overlap.

Revoke accessCopy Anchor Link

Revoke a key when a service is retired or a secret may be exposed. Revocation stops future authentication and preserves historical audit records. Updating the service alone does not revoke an old credential.

Key scope does not bypass consent, the service window, human ownership, sender connection, or provider safety rules. See API authentication for the first read-only check and errors for failures.