The Kanal API lets you interact with the platform's features programmatically. To keep your data confidential and your WhatsApp communications secure, every request sent to our servers must be authenticated.
Your API keys carry broad privileges on your Kanal account. They can send messages, access your contact lists, and view your statistics. Handle them with the greatest care.
Never share your secret API keys in publicly accessible places (such as public GitHub repositories).
Never embed your keys directly in client-side code (JavaScript running in the browser).
If you suspect a key has been compromised, revoke it immediately from your Kanal dashboard and generate a new one.
All API requests must be made over HTTPS. For security reasons, any call attempted over plain HTTP will always fail.
TLS encryption (HTTPS) ensures that data traveling between your server and the Kanal API cannot be intercepted by a third party.
Authentication with the Kanal API uses Bearer Auth (HTTP Bearer Authentication). You provide your API key as a token in the header of your HTTP request.
The header of your request must be structured as follows:
Authorization: Bearer <YOUR_API_KEY>
Here is a typical example of the structure of an authenticated request to our API:
curl -X GET "[https://api.getkanal.com/v1/endpoint](https://api.getkanal.com/v1/endpoint)" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"
If a request is sent without an authorization header or with an invalid or revoked API key, the Kanal server returns an authentication error (usually an HTTP 401 Unauthorized status code). Make sure the word "Bearer" comes right before your key and that the header contains no extra spaces.