WhatsApp API feature

Secure API Key Management for the WhatsApp API

Every Notivo request is authenticated with an API key. Give each application its own key and keep it on your server.

Get started Read the API documentation
cURL
# Option A: API key header
curl https://api.notivo.link/api/session/status \
  -H "x-api-key: YOUR_API_KEY"

# Option B: Bearer token
curl https://api.notivo.link/api/session/status \
  -H "Authorization: Bearer YOUR_API_KEY"

How does Notivo authenticate API requests?

Notivo authenticates each request with an API key. You send the key in the x-api-key header or as a Bearer token in the Authorization header. A key is linked to one WhatsApp session, so an application can only send through the session its key belongs to.

How do you start using an API key?

  1. Get your keySign in to the dashboard and copy the API key of the session you want to use.
  2. Store it on your serverKeep the key in an environment variable or a secrets manager, not in your source code.
  3. Send it with every requestUse the x-api-key header or a Bearer token over HTTPS.
  4. Check the responseA 401 means the key is missing or invalid. A 403 means access is denied for that key or session.

What does API key authentication give you?

Application-level keys

Use a separate key for each application so a website, an ERP and a script stay independent.

Session-linked access

A key works with the session it belongs to, and the session ID in a request must match it.

Two header styles

Send the key as x-api-key or as a standard Bearer token, whichever your client prefers.

Clear error codes

Standard 401 and 403 responses tell you whether a key is invalid or access is denied.

How do you keep an API key secure?

  • Call the API from your server only. Never put a key in browser JavaScript, a mobile app or a public repository.
  • Load the key from an environment variable or a secrets manager.
  • Use one key per application, so you know which system made a request.
  • Use HTTPS for every request.
  • Never write a key to your logs. Log the HTTP status and a safe error message instead.
  • If a key is exposed, replace it in your applications right away and review your dashboard for key options.

How does access control work?

Access depends on three things: the key itself, the permissions that belong to it, and the session it is linked to. If a request fails with 403, check the key's permissions, your account status, and whether the session in the request belongs to that key.

Is an API key the same as a webhook signature?

No. The API key proves who is calling Notivo. The HMAC signature on a webhook proves that Notivo is the one calling you. Use both: authenticate outgoing requests with your key and verify incoming webhooks with your signature secret.

Where do separate API keys help?

Website and ERP

Give your online store and your accounting system different keys.

Agencies

Use one key per client project and keep client integrations apart.

Test and live

Separate your development key from the key used in production.

Backend jobs

Run scheduled scripts with their own key and keep the credentials on the server.

See how this feature works with the rest of the platform, or browse all Notivo features.

WhatsApp Messaging API

Send messages with one REST endpoint and receive customer replies on your own webhook URL, signed so you can verify each request.

Read about Messaging API

Multiple WhatsApp Sessions

Connect more than one WhatsApp number and manage every session, each with its own API key, from a single dashboard.

Read about Multiple sessions

WhatsApp Integrations

Connect your ERP, CRM, WooCommerce store or custom software to WhatsApp through plain HTTP requests and webhooks.

Read about Integrations

Frequently asked questions: Secure API Key Management

Where do I find my API key?

Sign in to the Notivo dashboard and open your session. The API key is shown there.

Should I use x-api-key or a Bearer token?

Either works. Use x-api-key or the Authorization: Bearer header, whichever fits your HTTP client.

Can I use my API key in browser JavaScript?

No. Anyone who opens the page could copy it. Call the API from your backend instead.

What does a 401 or 403 response mean?

A 401 means the key is missing or invalid. A 403 means access is denied, for example because of the key's permissions or a session that does not belong to it.

Start with Secure API Key Management

Create your session, scan the QR code and send your first WhatsApp message through the Notivo API.

Get started Read the API documentation