Every request to the Riffre API is authenticated with an API key sent as a Bearer token in the Authorization header.

Authorization: Bearer rf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Creating a key

1. Sign in to your dashboard and open WhatsApp Accounts.
2. Choose the phone number you want to send from.
3. Open its API Keys tab and select Create API key +.
4. Copy the key immediately - Riffre stores only its cryptographic hash, so the raw key is shown once and cannot be retrieved again later.

Key format

A raw key always starts with rf_live_ followed by 48 hexadecimal characters. Requests with a malformed Authorization header (wrong prefix, wrong length, missing Bearer ) are rejected before any database lookup, with 401 Unauthorized.

A key is scoped to one phone number

Unlike some APIs, you do not pass a phone or sender ID in the request body - the sending phone number is implied entirely by which API key you use. Each key is created under a specific phone number and can only send messages from that number. If you operate multiple WhatsApp numbers, create a separate key for each one.

Key lifecycle

• Keys can optionally have an expiry date, set when the key is created or edited.
• A disabled or expired key is rejected the same way as an invalid key.
• Every successful request updates the key's "last used" timestamp, visible in the dashboard, so you can audit which keys are actually active.

Example

curl -X POST "https://riffrechat.com/api/v1/messages.php" \
  -H "Authorization: Bearer rf_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6" \
  -H "Content-Type: application/json" \
  -d '{"to": "919876543210", "type": "text", "text": {"body": "Hi"}}'

Authentication errors