Getting Started

Authentication

API v1 supports two integration methods: API key authentication (with IP whitelist) and OAuth 2.0 (Connect with Washeej).

1. API key authentication

Include both headers on every request. IP whitelisting is required for this method.

Header	Description
`client-id`	Public client identifier from Developer Tools. Alias: `X-Api-Key`.
`client-secret`	Secret key — never expose in client-side code. Alias: `X-Api-Secret`.

curl -H "client-id: YOUR_CLIENT_ID" \
     -H "client-secret: YOUR_CLIENT_SECRET" \
     https://staging-mobile.washeej.com/v1/account

IP whitelist If the caller IP is not whitelisted, the API returns ip_not_whitelisted (401) and the response message shows the IP Washeej sees. Add that IP under Developer Tools → IP Whitelist.

2. OAuth 2.0 (Connect with Washeej)

For third-party apps connecting end-user accounts (authorization code + PKCE). No IP whitelist is needed. See OAuth 2.0 (Connect with Washeej).

Using the OAuth 2.0 access token

After exchanging an authorization code, send the access token as a Bearer token:

Authorization: Bearer wat_...

Scopes on the token are enforced per endpoint. See Scopes.

Rate limits

120 requests per minute per account, shared by /v1 and the legacy /external-api. Exceeding the limit returns rate_limit_exceeded (429) with Retry-After: 60. The Device API (/device-api/v1) has its own limit of 100 requests per minute. POST /oauth/token is limited to 10 requests per minute. Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.