Authorization grants you access to the end‑customer account, allowing you to connect channels, send messages, and perform other actions on the end-customer's behalf.

Use simplified authorization if you operate under the White Label model. This allows you to obtain client tokens and act on behalf of end customers without requiring their direct interaction.

If you operate under the Wazzup Label model, obtain user tokens via OAuth instead.

How simplified authorization works: the partner first acquires a service machine_token, then exchanges it (token‑exchange) for tokens specific to a given end‑customer account.

Step 1. Create an end-customer account

Create an end‑customer account using the POST /v2/accounts method. You will then receive the customer's account_id, which is required to obtain user access tokens.

Save the account_id returned in the response — you will need it in Step 3.

Step 2. Obtain a machine_token

The machine_token is used to exchange it for user access tokens in the next step.

Request example

curl -L 'https://tech.wazzup24.com/v2/oauth/token' \
-H 'Authorization: Basic base64(email:password)' \
-H 'Content-Type: application/json' \
-d '{
"grant_type": "client_credentials",
"client_credentials_data": {
"scope": "transport,crm"
}
}'

Response example:

{
"data": {
"access_token": "eyJahkboGpppcilllO77iJ99IU12zI671NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjozmYzItOThjYS1kY2VjOWVjNTZjMTciLCJpYXQiOjE3NjMwMjc4NzYsImV4cCI6MTc2MzA1NjY3NiwianRpIjoiNWY3OWY0ZDgtZjNlYy00M2VhLTgyYjctMGI4YzJiZmU5hIn0.l",
"token_type": "Bearer",
"expires_in": 28800
},
"meta": {
"timestamp": 1763027876
}
}

Result: machine_token (returned in the response as access_token), which you will exchange for user access tokens in the next step.

Store the machine_token in a secure Secret Manager or vault. Never expose it to the frontend or client-side code.

Step 3. Exchange the machine_token for user access tokens

POST /v2/oauth/token
│
├── grant_type *
│
└── token_exchange_data *
  ├── subject_token *
  ├── subject_token_type *
  ├── requested_subject *
  └── scope *

token_exchange_data (object)

Request example

curl -L 'https://tech.wazzup24.com/v2/oauth/token' \
-H 'Authorization: Basic base64(email:password)' \
-H 'Content-Type: application/json' \
-d '{
"grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
"token_exchange_data": {
"subject_token": "eyJahkboGpppcilllO77iJ99IU12zI671NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjozmYzItOThjYS1kY2VjOWVjNTZjMTciLCJpYXQiOjE3NjMwMjc4NzYsImV4cCI6MTc2MzA1NjY3NiwianRpIjoiNWY3OWY0ZDgtZjNlYy00M2VhLTgyYjctMGI4YzJiZmU5hIn0.l",
"subject_token_type": "urn:wazzup:oauth:token-type:machine_token",
"requested_subject": "12345678",
"scope": "transport,crm"
}
}'

Response example:

{
"data": {
"access_token": "eyJhbGciOi...",
"refresh_token": "def50200...",
"token_type": "Bearer",
"expires_in": 86400
},
"meta": {
"timestamp": 1759481962
}
}

Result: You now have the end‑customer's client_access_token (returned as access_token in the response) for making API calls and a refresh_token for renewing it.

You can now proceed to add channels, send messages, and perform other actions.

Authorize all calls made on behalf of the end‑customer with the header: Authorization: Bearer <client_access_token>

Common errors

What's next

After authorization:

• connect channels, 
• subscribe to webhooks.