Documentation

Authentication

Every WhatSyncs API request is authenticated with a bearer token over HTTPS. Webhook deliveries use a separate signing secret, so verifying an inbound event never involves your write credential.

API keys

Create an API key in the WhatSyncs dashboard. Keys are scoped to one workspace and carry the permissions of that workspace — they can read conversations, send messages and manage connections within it, and nothing outside it.

Request headers

     Authorization  :   Bearer wsk_live_7f3c9a1e2b4d6f8a0c2e4b6d8f0a2c4e      Content-Type  :   application  /json

Rotating a key

Create a second key in the dashboard.
Deploy it to your service, replacing the old value.
Confirm traffic is flowing with the new key.
Revoke the old key. Revocation takes effect immediately.

Because more than one key can be active at a time, rotation does not require downtime.

Webhook signing secret

The signing secret is different from your API key and has one job: proving that an inbound webhook request genuinely came from WhatSyncs. See webhooks for the verification procedure.

Errors

Status	Meaning	What to do
`401`	Missing or invalid API key	Check the Authorization header format and that the key has not been revoked.
`403`	Key is valid but not permitted for this resource	The resource belongs to another workspace.
`404`	Resource does not exist in this workspace	Verify the connection or message identifier.
`429`	Rate limited	Back off and retry using the `Retry-After` header.

Everything on this page works on the Free plan, including webhooks and full API access.

Start Free

API keys

Request headers

     Authorization  :   Bearer wsk_live_7f3c9a1e2b4d6f8a0c2e4b6d8f0a2c4e      Content-Type  :   application  /json

Errors

Status	Meaning	What to do
`401`	Missing or invalid API key	Check the Authorization header format and that the key has not been revoked.
`403`	Key is valid but not permitted for this resource	The resource belongs to another workspace.
`404`	Resource does not exist in this workspace	Verify the connection or message identifier.
`429`	Rate limited	Back off and retry using the `Retry-After` header.