API keys
An API key lets your systems (CRM, website, automations) talk to WABOT on behalf of your business only. Available on Business and above.
- API → Keys → New key: a name (e.g. "CRM") and scopes: read (contacts, leads, appointments, calls, availability, events), write (leads, appointments, sending messages), calls (ordering an outbound call from the receptionist).
- The key, in the form
wab_live_<prefix>_<secret>, is shown once. We store only its hash — it cannot be recovered, only recreated. - Send it in the header
Authorization: Bearer <key>. The prefix is shown in the list so you can tell which key is used where, together with "last used". - Revoking is immediate.
A key sees only the data of the business that created it. Never put a key in client-side code (JavaScript in the browser) — server-side only.