Authentication | Meowsapp WhatsApp API

Account token

Send your token on every request, in either form:

Authorization: Bearer <token>
# or, equivalently
X-V3-Secret: <token>

A wrong or missing token returns 401 {"error": "unauthorized"}. Comparison is constant-time. The only unauthenticated routes are the health probes (/health, /health/live, /health/ready, /health/clients).

Server-side only

The account token controls every session on your account, including unpairing numbers. Never ship it to a browser or mobile app.

Per-session secrets

If you resell WhatsApp connections, or let a contractor integrate one number, give them a secret scoped to a singleclientId instead of your account token:

curl -X POST "https://api.meowsapp.com/set-api-secret" \
  -H "Authorization: Bearer $SN_TOKEN" -H "Content-Type: application/json" \
  -d '{ "clientId": "acmemain", "secret": "k9F2mQ7…at least 16 chars" }'

Requests that name that clientId (in the query string or JSON body) are then accepted with either your account token or the session secret. The secret cannot reach other sessions. Set "secret": "" to revoke it.

Authenticating our calls to you

When you register a webhook you choose a webhookToken. Every call we make to your webhookUrl (and to your optionalpollLookupUrl) carries it as Authorization: Bearer <webhookToken> plus User-Agent: Meowsapp-WhatsApp/1and X-SN-Event: <type>. Reject anything else with 401.

Rotation & hygiene

Rotate the account token by asking support; all callers must switch at the same time. Rotate session secrets yourself with /set-api-secret.
Generate webhookToken with at least 32 random characters and rotate it with /set-webhook — the change applies without restarting the session.
Serve your webhook over HTTPS only. Webhook URLs must be absolute https:// URLs.