AUTHENTICATION

Tokens

Every published endpoint is authenticated with a token in the Authorization header. There are two kinds, and sending is only ever done with the narrower one.

http

Authorization: Bearer wa_8Kq2NfR4pXsA71bTcVe3Yh6JmZq0Wd5Ln8Rt2Bx4Gk

# the bare form is accepted too, for Fonnte compatibility
Authorization: wa_8Kq2NfR4pXsA71bTcVe3Yh6JmZq0Wd5Ln8Rt2Bx4Gk

The two kinds

Field	Type	Description
Device token	one device	Scoped to exactly one device. This is what sends messages and reads their status — the endpoints on this site take nothing else. Create one on the device page in the dashboard.
Account token	your devices	Scoped to your account's devices, for managing them. It cannot send: /v1/send refuses it. Those management endpoints are not part of the published API.

A token is a credential for a real WhatsApp accountIt is shown once, at creation, and stored only as a hash — nobody can read it back to you, so put it straight into your secret store. Revoke it in the dashboard the moment you suspect it leaked. Tokens are never accepted in a query string, on any endpoint, so they stay out of access logs and browser history.

Base URL

Every path on this site is relative to this instance's API origin. Yours is:

text

https://api.sapa.tokoaplikasi.id

When a token is refused

A missing, malformed or revoked token answers 401 with { "status": false, "reason": "token invalid" }. An account token on an endpoint that needs a device token answers 403 forbidden. A message that is not this device's answers 404 message not found, never 403 — the API does not confirm that somebody else's id exists. Requests are rate limited per token; over the limit answers 429 with a retryAfter in seconds and a matching retry-after header.