Authentication

Every request needs an API key from Developer → API keys in the panel. Keys belong to your MeAPI account (licence). The owner, and agents whose role includes Developer API & webhooks → Create / revoke keys and webhooks, can create and revoke them. Each key needs a name. An account can have up to 20 active keys.

Send the key as a bearer token:

Authorization: Bearer mk_live_3f9c…

or, if your tool cannot set Authorization, in an X-API-Key header:

X-API-Key: mk_live_3f9c…

Keys start with mk_live_. Anything else is refused with 401 INVALID_API_KEY.

Keys and WhatsApp numbers

• A key limited to one number always sends from that number. It also only lists that number’s contacts and templates, and only reads messages of that number. Passing a different channel_id returns 403 CHANNEL_NOT_ALLOWED.
• A key for all numbers sends from your default number, or from the number whose id you pass as channel_id (in the JSON body or as a query parameter). Your number ids (channel_id) are listed in the panel under Developer → API reference, and every webhook event includes channel.id.

Keeping keys safe

• Keys are shown once and stored hashed — MeAPI cannot show a key again. Create a new one if you lose it.
• Use keys only on servers. Never put them in a mobile app, browser JavaScript or a public repository.
• Use one key per system, so you can revoke one without breaking the others. Revoking takes effect immediately.

Authentication errors

Status	Code	Meaning
401	NO_API_KEY	No key was sent
401	INVALID_API_KEY	The key is wrong or was revoked
402	SUBSCRIPTION_EXPIRED	Your MeAPI plan has expired — renew it in the panel
403	ACCOUNT_SUSPENDED	The account is suspended
403	CHANNEL_NOT_ALLOWED	The key may only use its own WhatsApp number

Requests that fail authentication do not count towards the rate limit.