Authentication

Every request is authenticated with an API key sent in the Authorization header. There is no Bearer prefix.

Authorization: bzp_live_7dQx1sVnKp0aZ2mB9tLcW4eR6yH3uJfG5iN8oPqXs

Key format

Production keys look like bzp_live_ followed by 43 alphanumeric characters. After creation the dashboard only shows its prefix (for example bzp_live_7dQx1s), so store the full key somewhere safe right away.

Organization

A key belongs to exactly one organization, and every request is scoped to it. There is no organization_id parameter anywhere in the API: it always comes from the key.

Restricting a key to numbers

• No restriction (default): the key can act from any WhatsApp number of the organization.
• One number: the key can only use that number, and its integration_id is injected automatically when you omit it.
• Several numbers: you must pass integration_id explicitly on routes that act from a number. Omitting it returns 403 INTEGRATION_ID_REQUIRED; a number outside the list returns 403 INTEGRATION_NOT_ALLOWED.

Revocation

Revoke a key from Settings → API keys. Authorization results are cached for up to 5 minutes, so a revoked key may keep working for that long. Rotate by creating the new key first, deploying it, then revoking the old one.