WizMessage provides a developer-friendly API that lets you connect your existing systems — your e-commerce store, CRM, helpdesk, or custom application — to drive chatbot actions, manage contacts, and send bulk messages programmatically. From this screen, you generate and manage API keys with enterprise-grade security: keys are hashed for safe storage, secrets are shown only once, and you can restrict access by IP whitelist and enforce rate and daily request limits. Set up outbound webhooks to receive real-time events (message received, delivered, read) with signature verification, and use the built-in Playground to test live API calls directly from your browser before writing any integration code.
API & Webhook Architecture
1
Admin
Generate Keys
Admin creates API key and secret.
3
System
Event Occurs
Message sent or delivered triggers a webhook.
1
2
3
4
2
Developer
Integrate API
Developer uses keys in external software.
4
System
Webhook Delivery
Payload signed and sent to developer server (up to 5 retries).
1
1
Admin
Generate Keys
Admin creates API key and secret.
2
2
Developer
Integrate API
Developer uses keys in external software.
3
3
System
Event Occurs
Message sent or delivered triggers a webhook.
4
4
System
Webhook Delivery
Payload signed and sent to developer server (up to 5 retries).
📊 Plan Requirement: API Management requires Wiz Bot or Wiz Pro. API calls and webhook deliveries are unlimited — no monthly message cap applies to API usage.
Create a new API key, set rate limits and IP whitelists, and copy the Secret Key (it is only shown once).
2
Step 2
Test in Playground
Open the Playground tab, select your key, configure message parameters, and send a live test request.
3
Step 3
Configure Webhooks
Set up a webhook URL to receive events, and use the generated Webhook Secret to verify payload signatures.
1
1
Step 1
Generate Keys
Create a new API key, set rate limits and IP whitelists, and copy the Secret Key (it is only shown once).
2
2
Step 2
Test in Playground
Open the Playground tab, select your key, configure message parameters, and send a live test request.
3
3
Step 3
Configure Webhooks
Set up a webhook URL to receive events, and use the generated Webhook Secret to verify payload signatures.
Tip: Treat API keys like passwords. Never commit them to Git repositories or hardcode them in frontend code. If a key is leaked, revoke or rotate it immediately.
API Key Format: Prefixed with pk_live_ (e.g., pk_live_abcd1234...). The first 12 characters are plain text for identification; the full key is hashed via SHA-256.
API Secret Format: Prefixed with sk_live_ (e.g., sk_live_xyz9876...). Shown only once upon creation.
Rate Limit: Maximum allowed requests per minute per key (defaults to 60).
Daily Limit: Hard daily cap on total requests per key (defaults to 1000).