PFNApp
Documentation
EnglishBahasa Indonesia
Console
Documentation/WhatsApp
Verified GuideWhatsAppEN

WhatsApp API Key Management

Generate, rotate, and securely use your organization's static WhatsApp API key to integrate with the WhatsApp Business Platform.

3 min read•Last updated 8/24/2026•/whatsapp/api-keys

This guide explains how to generate, rotate, and securely use your organization's static WhatsApp API key to integrate with the WhatsApp Business Platform APIs.

1. What is an API Key?

Your WhatsApp API Key is a secret token (like a password) that allows your backend software or scripts to send messages and manage devices securely.

Key Security Rules:

  • Shown Only Once: When you generate or rotate a key, the secret is displayed once. Copy it immediately to your password manager or environment file (.env).
  • One Active Key: Each organization uses one active key at a time.
  • Safe Sharing: You can safely share the key's prefix (e.g. wa_key_...) with colleagues for debugging without exposing the real secret.

2. Generating Your API Key

Step 1: Open the Console

Navigate to Console > WhatsApp > API Key (/console/whatsapp/api-keys).

If your organization does not yet have an active API key, the status badge will indicate Not generated.

Initial Not Generated State

Step 2: Generate the Key

  1. Click the "Generate API key" button.
  2. The system immediately provisions the key and presents the One-time API secret banner.
  3. Click "Copy secret" to copy your secret key to your password manager or environment secrets vault.

Key Generated with One-Time Secret

⚠️ Important: Once you navigate away or refresh the page, the secret cannot be shown again. If you lose the secret, you must rotate the key.

3. Key Lifecycle Management

Rotating an API Key

If you suspect your key has been leaked or your security policy requires periodic rotation:

  1. Click "Rotate API key".
  2. Read the confirmation dialog: The current key will stop working immediately.
  3. Confirm rotation to generate a new key and receive a fresh one-time secret.

Rotate API Key Confirmation Dialog

Revoking an API Key

To immediately terminate all API access without issuing a replacement key:

  1. Click "Revoke API key".
  2. Confirm the revocation dialog.
  3. The key status switches to Revoked, and incoming requests using this key will receive 401 Unauthorized.

Revoke API Key Confirmation Dialog

4. Authenticating API Requests

To authenticate requests to the WhatsApp API endpoints, provide your API key in standard Authorization: Bearer <API_KEY> header or x-api-key header.

Example: Checking WhatsApp Devices Status

Verify your API key and inspect connected WhatsApp phone numbers and device health:

BASH
curl -X GET "https://pfnapp.id/api/whatsapp/devices" \
  -H "Authorization: Bearer pfn_wa_sec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

OpenAPI Specification & SDK Reference

For detailed request/response schemas, query parameters, error codes, and SDK generation, refer to the interactive OpenAPI documentation:

5. Audit & Compliance

All API key lifecycle events are recorded in the immutable audit log:

  • ORGANIZATION_API_KEY_GENERATED
  • ORGANIZATION_API_KEY_ROTATED
  • ORGANIZATION_API_KEY_REVOKED

Organization administrators can view historical activity and fingerprint records under the Audit Logs tab in the management console.