Authentication
Every request carries an API key in the Authorization header. The key decides which application, which environment and which scopes the request has.
These examples use a placeholder address. Your console shows the exact address of the API for your workspace.
API keys#
Authorization: Bearer vx_live_<43 characters>
Authorization: Bearer vx_test_<43 characters>vx_live_keys belong to a live application.vx_test_keys belong to a sandbox application. A key whose prefix does not match its application is refused withenvironment_mismatch.- Vendrix shows the full key once, when you create it. Afterwards the console only shows a short preview such as
vx_live_...abcd. - A key can have an expiry date. A revoked or expired key stops working immediately.
- Only a workspace owner or admin can create or revoke keys.
Server to server only#
Call the API from your server. It sends no CORS headers and does not read cookies, so a browser cannot call it, and a key placed in a web page or a mobile app is a leaked key.
Scopes#
A scope allows one kind of call. A key can only use the endpoints whose scope it holds, otherwise the answer is 403 insufficient_scope and details.required_scope names the missing scope.
| Scope | Grants | Live | Sandbox |
|---|---|---|---|
system.status.read | GET /status | Yes | Yes |
connections.read | GET /connections, GET /connections/{id} | Yes | Yes |
templates.read | GET /connections/{id}/templates | Yes | Yes |
messages.send | POST /messages | Yes | Yes |
messages.read | GET /messages/{id} | Yes | Yes |
sandbox.events.write | POST /sandbox/events (sandbox keys only) | No | Yes |
Environments#
A sandbox key and a live key call the same endpoints. The sandbox answers with fixed fake data and never calls WhatsApp. Read the sandbox guide for the data it returns.