How keys are issued, what we can and cannot recover for you, and how to rotate one without downtime.
Every request carries the key as a bearer token. There is nothing else to sign and no session to establish.
A key is account-wide: it reaches every bridge on the account, so it belongs on your server, in an environment variable or a secret store - never in a mobile app, a browser bundle, or a repository.
curl https://wabridges.com/api/instances \ -H "Authorization: Bearer $WA_API_KEY"
The key is shown once, when you create it in Dashboard → API keys. After that we store only a hash of it and the last four characters, so nobody here can recover it - not support, not by asking nicely.
If a key is lost, create a new one and revoke the old one. The last four are shown in the dashboard, which is how you work out which key a running service is using without seeing either in full.
Keys are created and revoked in the dashboard, not through the API. A leaked key cannot be used to mint more keys.
An account can hold several keys at once, each with a label, and that is what makes rotation boring rather than an outage.
Create the new key, deploy it, confirm traffic is flowing under it, then revoke the old one. Because both work in the meantime there is no moment where a request has nowhere to go. Label keys after where they run - production, worker, staging - so revoking the right one later is not guesswork.
Revoking is immediate and cannot be undone. The next request using that key gets 401.
Revoke it first and ask questions afterwards - a new key takes seconds to issue, and anyone holding the old one can send from every number on your account until it is gone.
Then check what was sent. The dashboard shows recent activity per bridge, and we can help you read it if something looks wrong.
Something here not matching what you see? Write to us - a person answers.