Authentication

Every API call needs a bearer token:

Authorization: Bearer wsk_live_xxxxxxxxxxxxxxxxxxxxx

API keys

Create keys in Dashboard → API keys. A key is shown once and stored only as a hash, so we cannot show it again — if you lose it, revoke and create another.

Keys are scoped and restricted. Nothing is implicit:

Restriction	Effect
Scopes	Which endpoints the key may call. Anything else returns 403 scope_not_permitted.
Numbers	Which WhatsApp numbers the key may send from and read. Empty means all.
IP allowlist	Addresses or CIDR blocks allowed to use the key. Empty means any IP.

You can change all three later from the key's detail screen, or with PATCH /v1/keys/{id} — no need to hand out a new secret to tighten access.

Recommended setups

Use case	Scopes	Notes
Order notifications from your backend	messages:send, messages:read	Bind to the production number
Reporting job	messages:read	Read-only
Template management from a CMS	templates:read, templates:write
Local development	messages:send	Put your office IP in the allowlist

Sending the header

curl https://api.msgpanda.com/v1/numbers \
  -H "Authorization: Bearer $API_KEY"

Never put a key in a URL, in client-side JavaScript, or in a git repository. Keys are workspace-wide credentials: rotate them if they leak.

Editing restrictions

curl -X PATCH https://api.msgpanda.com/v1/keys/$KEY_ID \
  -H "Authorization: Bearer $DASHBOARD_SESSION" \
  -H "Content-Type: application/json" \
  -d '{ "scopes": ["messages:send"], "ip_allowlist": ["203.0.113.0/24"] }'

Returns 204 No Content.

Errors

Status	Code	Meaning
401	unauthorized	Missing, malformed, revoked or unknown key
403	scope_not_permitted	The key lacks the scope this endpoint needs
403	ip_not_allowed	The request did not come from the key's allowlist

caution

The IP allowlist is evaluated against the client address. If the API sits behind a proxy, only the first X-Forwarded-For entry is used — configure proxy trust before relying on IP restrictions in production.