How do I generate API keys?
Open the Whats91 customer dashboard, go to Developer API Tokens, and create or copy a public API token for server-side use.
Generate and manage managed w91_live_ API tokens from the Whats91 dashboard.
API Keys
Summary
Use this page to understand where public API keys are generated, how they should be stored, and how they are used with v3 endpoints.
Prerequisites
- Customer dashboard access
- Developer API token permission
Related documentation
Generate an API Token
Create managed tokens from Developer -> API Tokens in the Whats91 customer dashboard. New documentation should recommend managed w91_live_ tokens instead of legacy customer tokens.
- Open Developer -> API Tokens.
- Choose the active WhatsApp sender if the token should be number-specific.
- Click create token and enter a token name.
- Select expiration: one week, one month, three months, six months, one year, custom date, or never.
- Select scope: global, selected_number, or specific_number.
- Copy the generated token immediately. The full token is shown once only.
- Store it server-side in the integrating system and revoke old tokens when no longer needed.
Token Scopes
| Scope | Behavior |
|---|---|
| global | Token can resolve any allowed sender for the customer. |
| selected_number | Token is bound to the currently selected sender. |
| specific_number | Token is bound to a sender chosen from connected numbers. |
Warning
Managed tokens start with w91_live_. Whats91 stores only a SHA-256 hash, token prefix, and last four characters, along with scope, sender binding, expiry, last used time, revoked time, and status.
Operational Guidance
- Create separate tokens for production, staging, and each integration partner.
- Use number-scoped tokens when an integration should only send from one WhatsApp sender.
- Rotate tokens on a planned schedule and revoke unused tokens from Developer -> API Tokens.
- Keep legacy customer tokens out of new integrations; use managed w91_live_ tokens instead.
Frequently Asked Questions
Should API keys be used in frontend code?
No. Keep public API tokens on trusted servers and never expose them in browser-side JavaScript or mobile app bundles.
Can I rotate API keys?
Yes. Create a new token, update your server configuration, verify requests, and then disable the old token from the dashboard.