Authentication

How do I send the key?

X-API-Key

Your key, starting with tkw_live_.

Authorization

Alternatively, Bearer tkw_live_.... Use whichever your HTTP client prefers.

GET /v1/whatsapp/sessions HTTP/1.1
Host: api.tuskmail.africa
X-API-Key: tkw_live_...

Where do I create keys?

In the web app at app.tuskmail.africa/whatsapp, on the API keys tab. The key is shown once at creation. You can have up to 10 active keys and revoke any of them at any time, and a revoked key stops working immediately.

A key belongs to your account, so it can reach all of your sessions and none of anyone else’s. A session id that is not yours returns 404, exactly as if it did not exist.

What happens when authentication fails?

• A missing, wrong or revoked key returns 401 invalid_credentials.
• A disabled account returns 403 forbidden.
• A key whose WhatsApp plan is not active returns 402 payment_required. See plan and limits.
• Repeated failed attempts from one IP address are throttled with 429 rate_limited before the key is checked.