API authentication

Browser sessions use HttpOnly cookies set by /auth/login (and refresh/verify). Mutating requests must send the X-CSRF-Token header matching the wa_csrf cookie.

Programmatic access should use an API key from Platform settings. Send it as X-API-Key: wa_…. Bearer JWT access tokens remain supported for compatibility.

curl -H "X-API-Key: wa_your_secret" \
  https://api.example.com/api/v1/campaigns