Authentication & scopes

Every request authenticates with an API key, sent as a bearer token. Keys are account-scoped — a key acts on exactly one account, and there is no cross-account access.

Every request

Authorization: Bearer vp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys minted before September 2026 start with wacrm_live_ instead of vp_live_ — both formats keep working, no action needed.

Creating a key

In the dashboard: Settings → API keys → New API key. Only admins and owners can create keys.

Give the key a name (after the integration that will use it).
Grant the scopes it needs — nothing more.
Copy the key. The full key is shown exactly once. VyaparPing stores only a SHA-256 hash, so it can never be shown again — if you lose it, revoke it and create a new one.

Revoking a key

Settings → API keys → Revoke. Revocation is effective on the key's next request. Revoked keys stay in the list as an audit trail.

Scopes

A key can do only what its scopes allow, independent of who created it. Grant the minimum a given integration needs.

Scope	Allows
`messages:send`	Send WhatsApp messages
`messages:read`	Read messages and their delivery status
`contacts:read`	List and read contacts
`contacts:write`	Create and update contacts
`conversations:read`	List and read conversations
`broadcasts:send`	Launch broadcast campaigns
`webhooks:manage`	Register and manage outbound event webhooks

A key with no scopes still authenticates and can call GET /api/v1/me — useful for verifying a key works.

Response envelope

Every response uses one of two shapes:

Success

{ "data": { /* ... */ } }

Failure

{
  "error": {
    "code": "forbidden",
    "message": "This API key is missing the 'messages:send' scope"
  }
}

Branch on error.code — it's stable across releases. error.message is for humans and may be reworded.

Base URL for this instance

https://app.vyaparping.com/api/v1

Overview Errors & rate limits