Getting Started

Authentication

API v1 supports API keys (with IP whitelist) and OAuth 2.0 + PKCE bearer tokens.

1. API Keys

Include both headers on every request. IP whitelisting is required for this method.

Header	Description
`client-id`	Public client identifier from Developer Tools. Alias: `X-Api-Key`.
`client-secret`	Secret key — never expose in client-side code. Alias: `X-Api-Secret`.

curl -H "client-id: YOUR_CLIENT_ID" \
     -H "client-secret: YOUR_CLIENT_SECRET" \
     https://staging-mobile.washeej.com/v1/account

IP whitelist If the caller IP is not whitelisted, the API returns ip_not_whitelisted (401). Use GET /external-api/ping to discover your detected IP when debugging legacy credentials, then add it under Developer Tools.

2. OAuth 2.0 + PKCE

For third-party apps connecting end-user accounts. See OAuth Connect.

3. Bearer token

After exchanging an authorization code, send:

Authorization: Bearer wat_...

Scopes on the token are enforced per endpoint. See Scopes.

Rate limits

120 requests per minute per account. Exceeding the limit returns rate_limit_exceeded (429).