webapi.id Docs

Appearance

Authentication ​

The X-API-Key header ​

Every request to every product must include:

X-API-Key: wak_live_<40 hex characters>

There is no OAuth flow, no session, and no signing step for API calls themselves — GitHub OAuth (at console.webapi.id) is only how you manage keys in the dashboard, it's unrelated to how a request to api.webapi.id authenticates.

One key per product, not one key for your whole account ​

If you're subscribed to both geodoc and otpauth, you have two separate keys — using geodoc's key against /v1/otpauth/* returns 401 invalid API key, or key is not subscribed to otpauth, even though the key is otherwise valid. This is deliberate: a leaked or rotated key only ever affects the one product it was issued for.

You only see a key's plaintext once ​

The gateway stores a salted hash of your key, never the plaintext — functionally identical to how a password is stored. The dashboard shows the full key exactly once, right when it's generated (first login, or clicking Generate on a product you haven't subscribed to yet). After that, the dashboard only ever shows a short prefix (e.g. wak_live_7f3k...) so you can recognize which key is which, never the full value.

If you lose a key, there is no "reveal it again" — regenerate it instead from the dashboard. Regenerating:

  • Immediately invalidates the old key (it stops working, permanently).
  • Issues a brand new key, shown once, same as above.
  • Carries over that product's used quota for the current month — you don't get a free reset by regenerating.

You can also revoke a key outright without generating a replacement. Both actions take effect within seconds.

What a rejected key looks like ​

json
{ "error": "missing X-API-Key header" }
json
{ "error": "invalid API key, or key is not subscribed to geodoc" }

Both are HTTP 401. See Errors for the full list of status codes across every product, and note that otpauth specifically has an extra response shape layered on top of this one — see its own reference page before assuming every 401 from it looks like the examples above.