Getting started
Authentication
Every request carries one company’s API key. The key alone decides whose data a call reaches.
API keys
A key looks like ucik_ followed by two groups of letters and digits. The company’s Super Admin or Admin creates it under Settings → Urbanchat WhatsApp → API access. It is displayed once; the company keeps only a hash of it and cannot show it again.
- Up to five active keys per company, so a new one can be rolled out before the old one is revoked.
- A revoked key is refused from the very next request.
- The key decides the company. Any company id, slug or
page_idin a request is ignored. - The API works whether or not the company sends outbound WhatsApp messages. Revoking every key is how a company switches it off.
Sending the key
Send it in the X-API-KEY header. Authorization: Bearer is accepted too, which is what MCP clients use.
curl "https://www.chatcom.in/api/v1/urbanchat/catalog/categories" -H "X-API-KEY: ucik_xxxxxxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
curl "https://www.chatcom.in/api/v1/urbanchat/catalog/categories" -H "Authorization: Bearer ucik_xxxxxxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"When a key is refused
- 401
unauthorized - No key, a malformed key, an unknown key or a revoked one. All look the same on purpose.
- 403
forbidden - The key is valid, but the company’s account is not active, or its plan does not include orders and inventory.
- 429
rate_limited - More than 60 requests in a minute on this key. Wait for the number of seconds in
Retry-After.