WhatsApp API Keys: How to Keep Them Safe and What If Leaked

A freelance developer once pushed a project to a public code repository with the key sitting in a config file. Within a day, someone had used it to send messages that had nothing to do with the client. The client got blamed. The freelancer got a very bad week.

Cases like this don't need hackers. They need one careless copy and paste. The good news is that the habits that prevent it are simple.

What a key lets someone do

A WhatsApp API key proves to the provider that a request comes from you. Anyone holding it can send messages through your numbers, and in some setups read data tied to your account. That means spam sent in your name, a damaged sender reputation, and possibly a banned number. It can also mean customers' phone numbers exposed.

Where keys leak

• Code repositories, especially public ones, where a key is left in a source file.
• Front-end JavaScript on a website. Anything the browser downloads is public.
• Screenshots shared in support chats or social posts, with the key visible.
• Group chats and emails where someone pastes 'here's the key, just use this'.
• Shared spreadsheets and documents of 'logins for the team'.
• Old laptops and phones of former staff or freelancers.

Rules we follow

Keep it on the server only

The key belongs in your back end. If a button on your website needs to send a WhatsApp message, the button calls your server, and your server calls the API. We walk through that design in sending WhatsApp messages from your website.

Store it outside the code

Use an environment variable or a secrets manager, and keep the file that holds it out of version control. If you use Git, add that file to the ignore list on day one, before the first commit, not after.

Give each system its own key

One key for your website, a different one for your billing system, another for a contractor's test project. If one leaks, you revoke that single key and everything else carries on. A shared key forces you to break everything at once.

Use the least access available

If your provider lets you limit what a key can do, do it. In WA Getway you can create and manage API keys from the dashboard, and the admin can control each business account, so it's worth giving each integration its own key rather than reusing the main one.

If you think a key has leaked

1. 1Revoke or regenerate it immediately. Do this before you investigate. Speed matters more than curiosity.
2. 2Put the new key in your server's secure settings and restart whatever uses it.
3. 3Check your message logs for sends you don't recognise.
4. 4Look at your sender's status. If messages went out that shouldn't have, check for any warnings from the platform.
5. 5Find out how it leaked, and fix that, or it will happen again.

Rotation and staff changes

Rotate keys on a schedule that you will actually keep, say every few months, and always when someone with access leaves. It is boring work, and boring is the point. Document who owns each key so rotation doesn't turn into a treasure hunt. It is also worth putting a recurring reminder in your calendar, because rotation that depends on memory quietly stops happening.

Related protections

Small teams and shared access

In a five-person company it is tempting to keep one key in a shared note so anyone can use it. Resist that. Decide who truly needs the key, which is usually one developer or the owner, and let everyone else use the dashboard, where their actions are tied to their own login. Team members in a tool like WA Getway get their own accounts for this reason.

If a freelancer builds your integration, give them a key made for the project and revoke it at handover. Then generate a fresh production key that only your team has ever seen.

Keys protect sending. Your data also needs care on the receiving side, such as chat media stored on a server. We explain our own approach in why we delete media files every night. And when you're building your first calls, our REST API walkthrough shows where the key goes.

If you inherit a project and don't know where its keys live, ask us to review it. It's a short job, and far cheaper than cleaning up after a leak.