wa-service

API keys let external systems talk to wa-service without a human login. Typical uses:

• vlsasia.com order pipeline sending order-status WhatsApp templates automatically.
• XC Lighting scheduling/CRM firing site-visit reminders the day before.
• n8n / Zapier / Make.com workflows triggered by other apps.
• Cron jobs on a partner server pushing overdue-invoice templates.

The integration sends X-API-Key: wak_… on every request instead of logging in.

After creating a key with staff scope, your script can do:

curl -X POST https://wa.xjavprod.com/api/v1/conversations/6512345678/send \
  -H "X-API-Key: wak_yourkeyhere" \
  -H "Content-Type: application/json" \
  -d '{"text": "Your order has shipped!"}'

Replace 6512345678 with the customer's phone (digits only, country code first). The 24-hour customer-service window applies — for sending outside that, use /conversations/<phone>/send-template with an approved template.

curl -X POST https://wa.xjavprod.com/api/v1/conversations/6512345678/send-template \
  -H "X-API-Key: wak_yourkeyhere" \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": 1,
    "variables": ["Chan", "ORD-001", "shipped"]
  }'

template_id comes from the Templates tab. variables are the values that replace {{1}}, {{2}}, … in the template body.

• Pick the narrowest scope. Most integrations only need staff (send + read inbox). Reserve admin for keys that need to manage templates, users, or other keys.
• Use CIDR allowlist when you know the source IP. If your CRM server is at 203.0.113.45, restrict the key to 203.0.113.45/32. Stops the key from being useful if it ever leaks.
• One key per integration. Don't share keys across systems — you can't revoke one without breaking the other.
• Never commit a key to git. Store in a secrets manager or environment variable on the integration's server.
• Rotate periodically. Revoke + recreate every 6-12 months even if not compromised. The audit log records every api_key_created and api_key_revoked.

All endpoints accept either Authorization: Bearer <session_token> OR X-API-Key: wak_….

Full OpenAPI docs available at /api/docs (admin login required).