Authentication + scopes

Each API key has explicit scopes. Pick the smallest set that works.

| Scope | What it grants | |---|---| | messaging | Send outbound WhatsApp messages | | contacts | Read + write contacts | | conversations | Read conversations + messages | | flows | List + trigger flows | | templates | Read templates | | webhooks | Manage webhook subscriptions | | analytics | Read aggregated metrics | | gitops | Pull + push flows via CLI/SDK | | otp | Send/verify OTPs (legacy) |

Generating + rotating

/settings/api-keys → Create. The secret is shown once — copy it then. The DB only stores a SHA-256 hash + prefix.

Best practice

• One key per environment (dev / staging / prod)
• One key per integration if many — easier to revoke
• Set short names + audit lastUsedAt regularly