Authentication
Authenticate WhatsApp Business API requests with your HostMentor API key in the apikey header, and keep your keys safe on your server.
Every request needs your API key in the apikey header:
-H "apikey: hm_live_..."Each WhatsApp number has its own keys, and a key works for its own number only. Create and revoke a number's keys at app.hostmentor.com: open Messaging → WhatsApp, choose the number, then API keys and webhook. Team owners and admins can see that page, and so can developers who were given the number. A key works while its number's WhatsApp API plan is active.
A new key works within a minute, and a revoked one stops working within a minute.
Keep your keys secret. Anyone with a key can message your customers as your business and use your message credit.
- Use keys only on your server. Never put one in a website, mobile app or public code repository.
- If a key leaks, revoke it on the dashboard straight away and create a new one.
- Use a separate key for each system, so you can revoke one without stopping the others.
Requests without a valid key fail with HTTP 401 and the error invalid_api_key.