Authentication
Learn how to authenticate your API requests with API keys.
API key format
Wahlu API keys follow the format wahlu_live_.... Treat a key like a password: keep it on the server, never expose it in browser code and never commit it to source control.
Create an API key
Open Settings → API Keys in Wahlu. Give the key a clear name, select only the scopes it needs, and optionally restrict it to one or more brands. The secret is shown once, so copy it immediately.
Authorisation header
Send the key as a Bearer token on every authenticated request. The public platform-capabilities route is the only released route that does not require a key.
curl https://api.wahlu.com/v1/context \
-H "Authorization: Bearer wahlu_live_your_api_key_here"Released-operation scopes
These are the only scopes used by the 15 operations in the current public reference, including redacted receipt lookup and exact receipt-bound provider cleanup. A context read validates the key and returns its granted scopes, but does not itself require an additional scope.
| Parameter | Type | Description |
|---|---|---|
integrations:read | scope | List a brand's connected publishing targets and read live target-supported TikTok privacy choices. |
media:write | scope | Upload or import media and create an explicitly reviewed repair derivative. |
media:read | scope | Read one media item and its current processing readiness. |
posts:write | scope | Create an idempotent content draft or update the validated TikTok privacy choice on that same draft. |
schedule:write | scope | Run write-free preflight checks and create a pending-review Schedule. A rejected approval is reported as blocked until it is changed. |
schedule:read | scope | Read one accessible Schedule and its bounded status. |
publish:execute | conditional scope | Additional explicit authority required when approval_status is approved. |
Approval is separate authority
A key with schedule:write can safely create a Schedule withapproval_status: "pending_review". Creating an explicitly approved Schedule additionally requires publish:execute. Wahlu fails closed when that extra scope is absent.
Brand restrictions
A restricted key can access only its selected brands. A resource outside that boundary is not disclosed. Start with GET /v1/context and use only the returned brands and links.