# Authentication

> Docs index: https://wahasend.com/llms.txt · Everything in one file: https://wahasend.com/docs.md · API base URL: https://app.wahasend.com/api/v1

Send your key in the `X-API-Key` header on every request. Every product comes with API keys; a key reaches what your products include, nothing more (403 `PRODUCT_REQUIRED` otherwise).

```bash
curl https://app.wahasend.com/api/v1/me -H "X-API-Key: wn_8c1f…"
```

| Key | Looks like | Where | What it may call |
| --- | --- | --- | --- |
| Account key | `wn_…` | Dashboard → For developers (or the Connect page) | Everything your products include, as an organization **admin** (not team, ownership or deleting the organization). Pick a number with `containerId`. |
| Per-number key | `waha_…` | WhatsApp → the number → More settings | Sending and reading **through that number only**: `/alert/*`, `/otp/*`, `/recipients/*`, `/chats*`, `/contacts*`, `/bulk/*`, `/mcp`, and its own `/session/status\|qr\|pair\|start\|reconnect\|logout\|history\|profile`. Anything else answers 403 `NUMBER_KEY_SCOPE`. |

<a id="auth-products"></a>

### Which products can use the API

| Product | A key reaches |
| --- | --- |
| **Notify** | `/alert/send`, `/alert/batch`, `/alert/validate`, `/recipients/validate`, [campaigns](https://wahasend.com/docs/api/campaigns.md) `/bulk/*`, [reminders](https://wahasend.com/docs/api/reminders.md) `/reminders/*` |
| **Assistant** · **Shop** | `/alert/send`, the assistant routes `/bots/*` (Shop: catalogue and orders too), a [webhook](https://wahasend.com/docs/webhooks.md) for `bot.*` (and `commerce.order`) |
| **Developer** | Sending and batches, [OTP](https://wahasend.com/docs/api/otp.md) `/otp/*`, media sends, edit/delete/forward, every [webhook](https://wahasend.com/docs/webhooks.md) event |
| **Connect** | Sending and batches, [chats and contacts](https://wahasend.com/docs/api/inbox.md), the MCP endpoint `/mcp` |

Every product also reaches the [account and history](https://wahasend.com/docs/api/account.md) routes and the [WhatsApp number](https://wahasend.com/docs/api/numbers.md) routes. OTP, media sends and the full set of webhook events stay with Developer.

Give each app or server the smallest key it needs: a per-number key for a shop's checkout, the account key for your back office.

<a id="auth-bearer"></a>

### Bearer, for AI apps

Many MCP clients can only send `Authorization: Bearer …`. On the MCP endpoint (`/mcp`), `Authorization: Bearer YOUR_KEY` works exactly like `X-API-Key`. Elsewhere, use `X-API-Key`: `Bearer` there is for dashboard sessions.

<a id="auth-rotation"></a>

### Replacing a key

Regenerate a key from the same page (or `POST /me/regenerate-key`, `POST /session/:containerId/regenerate-key`). The old key stops working **at once**, so update your servers first if you can, then regenerate, then deploy the new key. There is one account key at a time. Keys are stored hashed: we can't show a lost key, only replace it.

> A key sends messages from your real number. Keep it on your server, never in a web page or a mobile app.

A deactivated account answers 403 `ACCOUNT_DEACTIVATED`; a missing or wrong key 401 `AUTH_ERROR` (`details.reason`: `missing_credentials` or `invalid_api_key`).