Authentication
Authenticate WhatsApp API requests with a brand-bound key.
Send the API key issued at onboarding as a bearer token:
Authorization: Bearer sk_live_…A key is bound to exactly one brand and one environment. An identifier owned by
another brand returns the same 404 as an identifier that does not exist, so
the API never confirms cross-tenant resource existence.
Keep keys server-side, load them from a secret store, and never put them in
browser code, logs, tickets, or webhook payloads. Do not edit the key prefix:
sk_test_ selects the simulator and sk_live_ selects the live channel.