API authorization

Every request to the WazzaBee API is authorized through the Authorization HTTP header with a Bearer token. The token is your API key, issued when you connect the API connector.

Header format

Authorization: Bearer YOUR_API_KEY

Base URL

https://api.wazzabee.com/api-gateway

All endpoints start with this base URL. For example, the full URL for sending a message is:

https://api.wazzabee.com/api-gateway/v1/messages/send

Where to get an API key

Log in to your WazzaBee dashboard
Go to the Connectors section in the side menu
Find the API card and click Connect
The API key is generated automatically and shown on the screen
Copy the key and keep it somewhere safe

⚠️ Security:

Never pass the API key in a URL or in request parameters
Do not publish the key in public repositories (GitHub, GitLab and the like)
Keep the key in environment variables, not in your code
If the key is compromised, deactivate the integration and create a new one

Request example

curl -X GET "https://api.wazzabee.com/api-gateway/v1/channels" \
  -H "Authorization: Bearer wac_live_sk_a1b2c3d4e5f6..."

Authorization error responses

The Authorization header is missing (401)

{
  "error": "The Authorization header is missing. Format: Bearer <api_key>"
}

Wrong key format (401)

{
  "error": "Invalid API key format"
}

The key is not found in the system (401)

{
  "error": "Invalid API key"
}

The integration is deactivated (403)

{
  "error": "The integration is deactivated"
}

Linking channels to an integration

Each integration can be linked to specific channels. That lets you limit an API key to just the channels it needs.

If no channels are set in the settings, the API key has access to all channels in the account
If channels are set, access is limited to the ones listed
An attempt to reach a channel outside that list returns a 403 error

Supported HTTP methods

Method	Endpoint	Description
`GET`	/v1/channels	List of channels
`POST`	/v1/messages/send	Send a message
`GET`	/v1/messages	Message history
`PATCH`	/v1/webhooks	Configure a webhook
`GET`	/v1/webhooks	Get the webhook settings
`POST`	/v1/iframe	Create an iframe session

CORS

You can call the API from your server or from a browser. The browser first sends an OPTIONS preflight request, and the API allows the method and the headers the browser listed. Write the method in capital letters: PATCH, not patch.

An API key in page code is visible to every visitor, so production requests are better sent from your server. The easiest way to connect a webhook is in your dashboard: "Connectors" → "API" → the "Webhook for incoming messages" block.