Authentication

WeZend uses two credential types, and most account-level endpoints accept either one.

API keys (server-to-server)

Send your key in the X-API-Key header. Keys are scoped to your account and meant for backend-to-backend calls.

curl https://api.wezend.com/v1/account/me \
  -H "X-API-Key: $WEZEND_API_KEY"

JWT bearer token (dashboard sessions)

Interactive sessions authenticate with a JWT obtained from POST /v1/auth/login, optionally followed by POST /v1/auth/mfa/verify when TOTP MFA is enabled on the account.

curl https://api.wezend.com/v1/account/me \
  -H "Authorization: Bearer $WEZEND_JWT"

Endpoints that accept either

A number of endpoints — sending messages, reading account data, creating an integration — run "flexible auth": they try X-API-Key first and fall back to a Bearer JWT, so the same integration code works whether it's called from your backend or triggered from the dashboard. Endpoints under /v1/admin/* and partner/agency endpoints are the exception — those are internal and staff/agency-only, not part of the customer-facing API surface.

Rotating keys

Rotate a key from Settings → API keys → Rotate (POST /v1/account/keys/:id/rotate). The old key stays valid for a 24-hour grace period, so you can redeploy with the new key without a service interruption.

Never ship an API key to a browser or mobile app — anything running on a device you don't control can be inspected. Call WeZend from your own backend, or use the public tracking key described in Tracking events, which is deliberately write-only and safe for the browser.