Authenticate your requests using Waply API keys

The Waply API uses API keys to authenticate requests. Every request you make must include your API key in the Authorization header as a Bearer token. Requests without a valid key are rejected with a 401 error.

Get your API key

API keys are generated from the Waply dashboard:

Open Settings

In the Waply dashboard, click Settings in the left sidebar.

Go to API Keys

Select API Keys from the Settings menu.

Create a new key

Click New API Key, give it a name (for example, “Production backend”), and click Create.

Copy your key

Copy the key immediately — it is only shown once. Store it in a secure secrets manager or environment variable.

Never commit your API key to source control or expose it in client-side code. Anyone with your key can make requests on your account’s behalf.

Authenticate a request

Pass your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_API_KEY

curl --request GET \
  --url https://api.waply.io/v1/contacts \
  --header 'Authorization: Bearer YOUR_API_KEY'

const response = await fetch('https://api.waply.io/v1/contacts', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.waply.io/v1/contacts',
    headers={
        'Authorization': 'Bearer YOUR_API_KEY',
        'Content-Type': 'application/json',
    },
)

print(response.json())

Replace YOUR_API_KEY with the key you copied from the dashboard. We recommend storing it as an environment variable:

const response = await fetch('https://api.waply.io/v1/contacts', {
  headers: {
    'Authorization': `Bearer ${process.env.WAPLY_API_KEY}`,
    'Content-Type': 'application/json',
  },
});

import os
import requests

response = requests.get(
    'https://api.waply.io/v1/contacts',
    headers={
        'Authorization': f'Bearer {os.environ["WAPLY_API_KEY"]}',
    },
)

Authentication errors

401 — Invalid API key

A 401 response means the API key in your Authorization header is missing, malformed, or has been revoked.

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key. Check your Authorization header."
  }
}

Check that you are using the correct key and that it has not been deleted from the API Keys page.

403 — Plan does not include API access

A 403 response means your Waply account is on the Starter plan, which does not include API access.

{
  "error": {
    "code": "forbidden",
    "message": "API access is not available on your current plan. Upgrade to Growth or Enterprise."
  }
}

Upgrade your plan from the Billing page in the Waply dashboard to resolve this.

Rotating API keys

You can generate multiple API keys for different environments or services. To rotate a key:

Create a new API key from Settings > API Keys.
Update your application to use the new key.
Delete the old key from the dashboard once traffic has moved over.

Use separate API keys for development, staging, and production environments so you can revoke a single key without affecting other environments.

​Get your API key

​Authenticate a request

​Authentication errors

​401 — Invalid API key

​403 — Plan does not include API access

​Rotating API keys

Get your API key

Authenticate a request

Authentication errors

401 — Invalid API key

403 — Plan does not include API access

Rotating API keys