Authentication

All InstaMessage API requests must be authenticated using an API key.

Authentication is performed by sending your API key in the Authorization header of each request.

InstaMessage uses API key authentication.

Each API request must include a valid API key issued to your account.

Authorization: Bearer YOUR_API_KEY

You can find your API key in the InstaMessage dashboard:

1. Go to Admin → API
2. Select Show Key under API Live Key
3. Copy your Account Name and API Key

Your API key is tied to your InstaMessage account and authorises access to all InstaMessage APIs.

Important: Treat your API key like a password. Never share it publicly or commit it to source control.

Each account currently has a single active API key. Subaccounts and multiple environments will be supported in future.

Include the Authorization header in every API request.

Example request

curl -X POST https://api.instamessage.co.uk/v1/messages \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

This authentication method applies to all REST API endpoints, including:

• Sending messages
• Managing contacts and groups
• Managing opt-outs
• Managing WhatsApp templates
• Triggering journeys and automated messaging flows
• Configuring webhooks

If authentication fails, the API responds with HTTP 401 – Unauthorized.

Some endpoints may return a JSON error body, for example:

{ "error": "Unauthorised." }

You can regenerate your API key at any time from the InstaMessage dashboard.

To regenerate your key:

• Go to Admin → API
• Select Regenerate Key under API Key Live
• Confirm the action

Once regenerated:

• The old API key is immediately invalidated
• All requests using the old key will fail with 401 Unauthorized
• You must update the API key everywhere it is used (servers, background jobs, integrations)

Regenerating your API key will cause downtime if your applications are not updated immediately.

• Never expose your API key in client-side code (JavaScript, mobile apps)
• Store API keys securely using environment variables or a secrets manager
• Rotate your API key immediately if it is compromised
• Restrict access to servers that require API access

Once authenticated, you can:

• Contacts → Create, update and enrich contacts
• SMS → Send your first SMS
• WhatsApp → Send your first WhatsApp
• RCS → Send your first RCS
• Send a Message → Full message payload reference
• Webhook Quick-Start → Receive inbound messages and delivery updates

Authentication is required for all API interactions with InstaMessage.