Getting Started
Authentication
API v1 supports API keys (with IP whitelist) and OAuth 2.0 + PKCE bearer tokens.
1. API Keys
Include both headers on every request. IP whitelisting is required for this method.
| Header | Description |
|---|---|
client-id | Public client identifier from Developer Tools. Alias: X-Api-Key. |
client-secret | Secret key — never expose in client-side code. Alias: X-Api-Secret. |
Example
curl -H "client-id: YOUR_CLIENT_ID" \
-H "client-secret: YOUR_CLIENT_SECRET" \
https://app.washeej.com/v1/account
IP whitelist
If the caller IP is not whitelisted, the API returns
ip_not_whitelisted (401). Use GET /external-api/ping to discover your detected IP when debugging legacy credentials, then add it under Developer Tools.
2. OAuth 2.0 + PKCE
For third-party apps connecting end-user accounts. See OAuth Connect.
3. Bearer token
After exchanging an authorization code, send:
Header
Authorization: Bearer wat_...Scopes on the token are enforced per endpoint. See Scopes.
Rate limits
120 requests per minute per account. Exceeding the limit returns rate_limit_exceeded (429).