Skip to main content

API Authentication

Learn how to authenticate your API requests to WizChat.

Overview​

All API requests require authentication using an API key.

Getting an API Key​

  1. Go to "Settings" > "API"
  2. Click "Generate API Key"
  3. Give the key a name (e.g., "Production API")
  4. Select permissions
  5. Click "Create"
  6. Copy the key immediately
warning

API keys are shown only once. Store them securely.

Using Your API Key​

Include the API key in the Authorization header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.wizchat.com/v1/chatbots

Header Format​

Authorization: Bearer YOUR_API_KEY

Key Permissions​

When creating a key, choose permissions:

PermissionDescription
ReadView chatbots, queries
WriteSend messages, update settings
AdminFull access including delete

Read-Only Key​

{
  "name": "Analytics Integration",
  "permissions": ["read"]
}

Full Access Key​

{
  "name": "Backend Service",
  "permissions": ["read", "write", "admin"]
}

Key Management​

Viewing Keys​

  1. Go to "Settings" > "API"
  2. See all active keys
  3. View last used date

Revoking Keys​

  1. Find the key in the list
  2. Click "Revoke"
  3. Confirm revocation

Revoked keys stop working immediately.

Rotating Keys​

Best practice: rotate keys periodically.

  1. Create a new key
  2. Update your applications
  3. Revoke the old key

Security Best Practices​

Do​

  • Store keys in environment variables
  • Use different keys for different environments
  • Rotate keys regularly
  • Use minimum required permissions
  • Monitor key usage

Don't​

  • Commit keys to version control
  • Share keys via email or chat
  • Use production keys in development
  • Give more permissions than needed

Environment Variables​

Store your API key in environment variables:

# .env file
WIZCHAT_API_KEY=your_api_key_here
// Access in code
const apiKey = process.env.WIZCHAT_API_KEY;

Error Responses​

Invalid Key​

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key"
  }
}

Missing Key​

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key required"
  }
}

Revoked Key​

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key has been revoked"
  }
}

IP Restrictions​

Optionally restrict keys to specific IPs:

  1. Go to "Settings" > "API"
  2. Click on a key
  3. Add allowed IP addresses
  4. Save