Authorization provides access to an end-customer account, allowing you to connect channels, send messages, and perform other actions on the customer's behalf.

Use this authorization flow if you operate as a Wazzup Label partner. The end customer will register or log into their Wazzup account → grant your partner application access via iframe/redirect. You will receive the customer's client_access_token and refresh_token, which enable you to make API requests on their behalf.

Step 1. Direct the end customer to /v2/oauth/authorize

The first step is to generate a URL for the end‑customer to log into their Wazzup account.

Once you have generated the URL with all required parameters, direct the end‑customer to it → the customer logs into Wazzup → your redirect_uri will receive a code parameter. This code can then be exchanged for user access tokens in the second step.

Query parameters:

We use OAuth with the PKCE extension. Therefore, requests must include a code_verifier and a code_challenge.

code_verifier is a secret random string that must be:

• generated by your application
• composed only of English letters, numbers, and the following characters: -, ., _, ~
• between 43 and 128 characters in length, inclusive

Example: dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

code_challenge — is a secured representation of the code_verifier, created by:

• hashing the code_verifier using the SHA-256 algorithm
• then encoding the result in Base64URL format

Request example:

GET https://tech.wazzup24.com/v2/oauth/authorize
?response_type=code
&client_id=partner_client_id
&redirect_uri=https%3A%2F%2Fyour.website%2Fcallback
&scope=transport%2Ccrm
&state=state_tech_partner_123
&code_challenge=EADnwig85jbEO4pP09-AMi-JnGf7VnO9DS9rvHsq5sY
&code_challenge_method=S256

After the end customer logs into Wazzup using the provided link, Wazzup will redirect to your redirect_uri with the following parameters:
?code=...&state=....

Verify that the state value received from Wazzup matches the one you sent in the initial request.

Save the code value from the browser's address bar. Copy the value of the "code=" parameter up to the "&state" delimiter.

Common errors at Step 1

Step 2. Exchange the received code for user access tokens

POST
│
├── grant_type *
│
└── authorize_code_data *
  ├── code *
  ├── redirect_uri *
  ├── client_id *
  └── code_verifier

authorize_code_data (object)

Request example:

curl -X POST 'https://tech.wazzup24.com/v2/oauth/token' \
-H 'Authorization: Basic base64(email:password)' \
-H 'Content-Type: application/json' \
-d '{
"grant_type": "authorization_code",
"authorize_code_data": {
"code": "AUTH_CODE_FROM_REDIRECT",
"redirect_uri": "https://your.app/callback",
"client_id": "your_client_id",
"code_verifier": "ORIGINAL_CODE_VERIFIER"
}
}'

Response example:

{
"data": {
"access_token": "eyJhbGciOieyJhbGciOieyJhbGciOieyJhbGciOieyJhbGciOieyJhbGciOieyJhbGciOieyJhbGciOi",
"refresh_token": "def50200def50200def50200def50200def50200def50200def50200",
"token_type": "Bearer",
"expires_in": 86400
},
"meta": {
"timestamp": 1759481570
}
}

Result: you now have the end-customer's client_access_token (returned as access_token in the response) for making API calls and a refresh_token for renewing it.

You can now proceed to add channels, send messages, and perform other actions.

Authorize all calls made on the end-customer's behalf with the header: Authorization: Bearer <client_access_token>

Common errors at Step 2

What's next

After authorization:

• connect channels, 
• subscribe to webhooks.