Skip to main content

​
Authentication

The Wappfy API supports two authentication methods. All requests must include one of these. Pass your API key in the X-Api-Key header: 
curl https://api.wappfy.io/api/instances \
  -H "X-Api-Key: wappfy_sk_abc123def456..."

​
Creating an API key

API keys are created via the dashboard or the API. Keys are scoped to a user and have the same permissions as the user’s account. 
curl -X POST https://api.wappfy.io/api/api-keys \
  -H "Authorization: Bearer YOUR_SUPABASE_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Production Key" }'
The key value is only returned once at creation time. Store it securely.

​
Bearer Token (Supabase JWT)

Pass a Supabase access token in the Authorization header: 
curl https://api.wappfy.io/api/instances \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
JWT tokens are short-lived and must be refreshed. They are typically used by the frontend dashboard, not for server-to-server integrations.

​
Security best practices

API keys don’t expire and are easier to manage for backend integrations.
If a key is compromised, delete it and create a new one.
All API requests must use HTTPS. HTTP requests will be rejected.
API keys should only be used in server-side code, never in client-side JavaScript.

​
Error responses

StatusDescription
401Missing or invalid authentication token
403Insufficient permissions for this resource