API overview & authentication — Docs

Connect your website or back-office systems to Wazline and send WhatsApp messages with a simple HTTPS API.

The Wazline API lets your own systems send WhatsApp messages from your business number — an order confirmation the moment someone checks out, a reminder before an appointment, or an update from your CRM.

Endpoints

Method	Endpoint	Use it to
`POST`	`/api/external/send-template`	Send an approved template. Works at any time. Reference
`POST`	`/api/external/send-message`	Send free-form text. Only within the 24-hour window. Reference

Every message you send is saved to the customer’s conversation in the Team Inbox, so agents always see the full history.

Base URL

Use your workspace domain — the address you sign in to Wazline at — over HTTPS:

https://YOUR_WORKSPACE_DOMAIN/api/external/

Create an API client

API access is managed in API Clients, under Operations in the Admin Panel. Your package must include API Clients.

Fill in New API Client:
- Website Title — a name you’ll recognise, for example Online store.
- Allowed Host — the domain your requests come from, for example yourstore.com. Each host can belong to only one client.
- Linked WhatsApp Number — the number messages are sent from.
Click Create Client.
Copy the token straight away. It starts with wzln_ and is shown only once — Wazline keeps only a hash of it.

Authenticate

Send the token as a bearer token, and identify your host with the Origin header:

POST /api/external/send-template HTTP/1.1
Host: YOUR_WORKSPACE_DOMAIN
Authorization: Bearer wzln_your_token_here
Origin: https://yourstore.com
Content-Type: application/json
Accept: application/json

Header	Required	Value
`Authorization`	Yes	`Bearer` followed by your API token
`Origin`	Yes	`https://` plus your Allowed Host. Subdomains of that host are accepted. A `Referer` from the same host also works.
`Content-Type`	Yes	`application/json`
`Accept`	Recommended	`application/json`, so every error comes back as JSON

Important: Requests with no Origin or Referer header, or from a different host, are rejected with 403 host_not_allowed. Browsers set Origin automatically; from a server, set it yourself.

Keep your token safe

Call the API from your server — never from browser JavaScript or a mobile app, where anyone could read the token.
Keep the token in an environment variable or a secrets manager, not in your code repository.
If a token leaks, click Regenerate token. The old token stops working immediately. You can also disable a client for a while, or delete it.

Monitoring

API Clients shows each client’s status, Successful Sends and Last Used time, plus totals for all your clients. Every call that reaches the API is logged, whether it succeeds or fails.

Limits

Each endpoint accepts up to 60 requests per minute. See Errors & rate limits for the details and every error code.