How do I create, reveal, and roll a WhatsAble API key?
WhatsAble API keys on Pro and Agency. Owners and Admins create a key for Zapier, Make, n8n, or their own code, reveal and copy it again at any time, roll it to replace the secret, or revoke it.
An API key lets your own code, Zapier, Make, or n8n send messages and read data as your WhatsAble organization. You manage keys on Settings → API keys. You can reveal and copy a key again at any time, so a lost key does not mean a broken integration. You can also roll a key to replace its secret, or revoke it.
API keys are part of the Pro and Agency plans, which include integrations. Bulk Message does not include them. See plans.
Treat a key like a password. Anyone with the key can message your contacts. Keep it on your server, not in an app or a web page.
Who can manage keys
The owner and Admins can open Settings → API keys. A Member cannot open the page.
Create a key
You need a connected WhatsApp number before you create a key.
Open API keys
Go to Settings → API keys and select Create API key.
Name the key
Enter a Key name of 1 to 80 characters. Name it after the place it will be used, such as "Zapier production".
Choose the number
Choose the Number the key sends from. To let the key use more numbers, open Advanced and choose Only this number, All numbers, or Specific numbers.
Choose what the key can do
Under What this key can do, choose Full access, Send and read, Read only, or Custom.
Create and copy
Select Create key. The page shows Your new API key. Select Copy key, then paste the key where you need it.
What each access level allows
| Access | What the key can do |
|---|---|
| Full access | Everything the API can do, including anything added later. |
| Send and read | Send messages, read everything, update contacts, and switch the AI agent on or off. It cannot create templates, labels, or broadcasts, edit AI agents, or manage webhooks. |
| Read only | Read numbers, templates, messages, contacts, broadcasts, and AI agents. It cannot send or change anything. |
| Custom | The permissions you pick. |
These limits apply to API v1. Requests to the older API, which existing integrations use, are not limited by them.
Reveal and copy a key
You can show the full key again at any time.
- Go to Settings → API keys.
- On the key's row, select Reveal. The full key shows.
- Select Copy. To hide the key again, select Hide.
Revealing a key does not change it. Every integration that uses the key keeps working. WhatsAble records who revealed a key and when. One person can reveal keys at most 10 times a minute.
A key that cannot be revealed
Some older keys show this message: "This key cannot be revealed. Roll it to get a key you can reveal." WhatsAble keeps no copy of such a key that it can show. The key can become revealable after it next sends a request successfully. If you need the key now, roll it.
Roll a key
Rolling a key replaces its secret. Use it when a key may have leaked, or when you cannot reveal a key.
- On the key's row, select Roll key.
- Confirm that connections that use the old key will break.
- Select Roll key to confirm. The page shows the new key. Copy it.
The old secret stops working at once. Every connection that uses it fails until you paste the new key. The key's name and numbers stay the same.
Revoke a key
Revoking a key stops it for good. Use it when a key is no longer needed.
- On the key's row, select Revoke.
- Confirm that your integrations will stop sending.
- Select Revoke now.
Every integration that uses the key stops sending at once. You cannot undo a revoke, and you cannot reveal or roll a revoked key. To keep sending, create a new key first and update your integrations. The Revoked keys list shows the keys you revoked.
Reveal, roll, or revoke
| You want to | Do this | What happens to your integrations |
|---|---|---|
| Find a key you lost | Reveal | They keep working. |
| Replace a key that may have leaked | Roll key | They stop until you paste the new key. |
| Stop a key you no longer use | Revoke | They stop for good. |
Use the key
- Zapier. When Zapier asks you to connect WhatsAble, paste the key. See Zapier.
- Make. Install the WhatsAble app in Make, then paste the key when it asks to connect. See Make.
- n8n. Install the WhatsAble node in n8n, then paste the key when it asks. See n8n.
- Your own code. API v1 reads the key from the
Authorizationheader, asAuthorization: Bearer <your key>.
How API keys work with other features
Team roles
Only the owner and Admins can create, reveal, roll, or revoke a key. A key acts for the whole organization, not for a person. A key does not take a team seat. See team seats.
Numbers
A key sends from its default number. It can also use all numbers or a chosen few. Triggers that you register with a key receive only the messages of that key's numbers. To change the numbers later, use Change number or Edit numbers on the key's row. Rolling a key keeps its numbers.
Labels, templates, and broadcasts
A Full access key can create labels, templates, and broadcasts. A Send and read key can read them and update contacts, but it cannot create them. See the team inbox for how labels organize conversations.
The AI agent
A Read only or Send and read key can read your AI agents. A Send and read key can also switch the AI agent off or back on in one conversation, and choose which agent answers a number. Only a Full access key, or a Custom key that allows it, can create or edit an agent. A Send and read key created before this change keeps the permissions it had and shows as Custom; create a new key to get the switch. See AI chatbots.
Webhooks
Only a Full access key, or a Custom key that allows it, can manage webhooks. See message webhooks.
Related
Zapier
Connect WhatsAble to Zapier with an API key.
Make
Connect WhatsAble to Make with an API key.
n8n
Connect WhatsAble to n8n with an API key.
Team seats
What a teammate costs, and how to remove an empty seat.
FAQ
I lost my API key. Do I need a new one?
No. Go to Settings → API keys and select Reveal on the key's row. Then copy the key. Your integrations keep working.
Does revealing a key change it?
No. Revealing shows the same key. Only Roll key replaces it.
What happens to Zapier or Make when I roll a key?
The old key stops working at once. Each connection fails until you paste the new key into it.
Can a Member see API keys?
No. Only the owner and Admins can open Settings → API keys.
Can I undo a revoke?
No. A revoked key stops for good. Create a new key and update your integrations.
How do team seats work in WhatsAble?
WhatsAble team seats on Pro and Agency. The owner seat is free, and each teammate is $12 a month, charged when they accept the invitation. A removed teammate leaves an empty paid seat until the owner removes it in Billing.
Zapier
Notifyer System triggers and actions in Zapier — incoming and outgoing WhatsApp messages, including replies typed in the WhatsApp Business app. Coexistence is supported; you do not delete the app on your phone.