Skip to main content
The Wave API authenticates with API keys sent as a Bearer token:

​
Key types

New accounts start in sandbox. Move to production through the Go-Live flow in the dashboard (a short review) — that mints your sk_live_ key and lifts the sandbox limits. Some features (recordings, virtual numbers, queues) require a production key.

​
Getting a key

API keys are created and managed in the Wave dashboard (not via the API):
  1. Log in at wave.sa.
  2. Open API Keys.
  3. Copy the key on creation — it is shown once.
To rotate, use Revoke & Regenerate in the dashboard. The old key stops working immediately and a new one is issued atomically.

​
Scopes

Each key carries scopes that gate what it can do. Set them when you create or edit a key in the dashboard. A request for something outside a key’s scopes returns 403 INSUFFICIENT_PERMISSIONS.

​
Sending the key

Every request must include the Authorization header. Requests without a valid key return 401 with the standard error envelope.
Keep keys on your server and out of source control. The one exception is Web Calling: the browser SDK uses a webrtc:write key that Wave origin-locks to your allowed origins — scope that key to webrtc:write only and add it just to the origins you control.