---
title: Authentication | API Docs
description: Authenticate WhatsApp API requests with a brand-bound key.
---

Send the API key issued at onboarding as a bearer token:

```
Authorization: Bearer sk_live_…
```

A key is bound to exactly one brand and one environment. An identifier owned by another brand returns the same `404` as an identifier that does not exist, so the API never confirms cross-tenant resource existence.

Keep keys server-side, load them from a secret store, and never put them in browser code, logs, tickets, or webhook payloads. Do not edit the key prefix: `sk_test_` selects the simulator and `sk_live_` selects the live channel.