Sign inRequest access

Authentication

Every request to https://api.warsita.com carries a credential in the Authorization header:

Authorization: Bearer <credential>

There are two kinds. Use the API key in the code that sends messages, and the personal access token in tools that manage sessions.

Session API key Personal access token
Looks like wsk_… wsp_…
Belongs to One session (one WhatsApp number) A workspace
Created When you create a session; regenerate it on the session's page Dashboard → Settings → Access Tokens
Can call Messages, contacts and groups Everything, including sessions and webhooks
Picks the session The key itself session_id in the body or query

Both are shown once. Warsita stores only a hash, so a lost key cannot be recovered: create a new one.

Session API keys

An API key works for the session it was made for, so requests need no session id:

curl https://api.warsita.com/v1/messages?limit=10 \
  -H "Authorization: Bearer wsk_…"

Regenerating a key (POST /v1/sessions/{id}/api-key, or Regenerate in the dashboard) replaces it at once. API keys cannot manage sessions: /v1/sessions… answers 401 to them.

Personal access tokens

A token acts for the whole workspace. Use it to create and link sessions, change their settings and webhooks, and read their logs:

curl https://api.warsita.com/v1/sessions \
  -H "Authorization: Bearer wsp_…"

When a token calls a messages, contacts or groups endpoint, name the session with session_id: in the JSON body for POST, in the query string otherwise.

curl https://api.warsita.com/v1/messages \
  -H "Authorization: Bearer wsp_…" \
  -H "Content-Type: application/json" \
  -d '{"session_id": "ses_3kV9mQ2pX7aL0zR5tN8w", "to": "+6281234567890", "text": "Hi"}'

Anyone in the workspace can create tokens; revoke one in Settings → Access Tokens and it stops working at once.

Keeping credentials safe

  • Keep keys and tokens on your server, never in a browser or mobile app.
  • Give each app its own session or token, so you can revoke one without touching the others.
  • A request without a valid credential gets 401 with the code unauthorized. See Errors and Limits.
NextSessions