Developers

Developer Tools

A Bearer key for your own code, webhooks for everything that happens, and a 94-tool MCP server for AI clients.

API keys

Where Settings → Developers

Generate a key, then authenticate with Authorization: Bearer sk_live_...

Create as many keys as you need, name them per application, and revoke one without breaking the rest. Each key has a message-read toggle.

Rate limit: 60 requests per minute, with X-RateLimit-Limit, -Remaining and -Reset on every response.

REST API — 11 endpoints

            Method
            Path
          

GET /api/v1/instances

GET /api/v1/instances/qr

GET /api/v1/groups

POST /api/v1/send

POST /api/v1/send-template

GET /api/v1/templates

POST /api/v1/templates/sync

GET /api/v1/contacts

GET /api/v1/chats

GET /api/v1/session-window

GET /api/v1/status

GET /api/v1/docs returns the whole reference as JSON.

curl -X POST https://nakwasap.my/api/v1/send \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"instanceName":"my-device","number":"60123456789","type":"text","text":"Hi"}'

A response of {"queued": true} means it entered the anti-ban queue and will send on schedule. Do not resend.

Webhooks

Where Settings → Webhooks

Webhook config with the event checkboxes

Six events: message.received · message.sent · message.status_update · contact.created · contact.updated · instance.status_changed

Each delivery is signed with HMAC-SHA256 in X-Webhook-Signature. Media messages arrive with a directly fetchable media_url. Every attempt is logged with status, response body and duration. A Test button lets you build your handler before real traffic arrives.

Delivery is fire-and-forget with a 10-second timeout. There are no retries — respond fast and queue work on your side.

MCP server

Where Integrations → AI Assistant

94 tools that let Claude, ChatGPT, Claude Code, Cursor or n8n operate your workspace directly.

claude mcp add --transport http nakwasap \
  https://nakwasap.my/api/mcp \
  --header "Authorization: Bearer sk_live_xxxxxxxxxxxx"

For claude.ai and ChatGPT, paste the server URL and approve the consent screen — no key to leak.

Eight scopes: read · messages · crm · campaigns · pages · automations · ai_agent · sales

Every tool also checks the matching team permission, and results are filtered to the numbers that connection may see. Message reading is its own switch. Revoke any connected app without touching your keys.

NextTeam & Permissions→