Command Palette

Search for a command to run...

IntelliPortalDOCS

Start here

  • Overview
  • Quickstart
  • Test in the sandbox

Build

  • Authentication
  • Clients
  • Hosted onboarding
  • Webhooks

API reference

  • Messages
  • Usage
  • Status & observability

Reliability

  • WhatsApp limits
  • Errors & debugging

Resources

  • Changelog
  • OpenAPI 3.1
  • Postman collection
Developer support
IntelliPortalDOCS
Developer documentation/API v1

© 2026 Intelli Holdings Inc.

PrivacyContact

Need a hand?

Share a request ID when you contact us so we can trace the call quickly.

Open developer support
  1. Docs
  3. Authentication

Core concept

Bearer auth

Authentication

Authenticate server-to-server requests with scoped API keys. Test and live keys share one contract but have intentionally different delivery behavior.

Send a Bearer token

Put the key in the Authorization header on every protected request. Keys are secrets: do not send them in a query string, log the full value, or ship them in frontend JavaScript.

HTTP
GET /v1/clients HTTP/1.1
Host: api.intelliconcierge.dev
Authorization: Bearer ik_test_your_key

Keys are shown once

IntelliPortal stores a SHA-256 hash and a short identifying prefix, not the plaintext secret. Copy the key into a server-side secret manager when it is created.

Test keys and live keys

ik_test_
Safe validation
Send requests through the real validation and routing path without delivering a message. Test traffic is excluded from usage.
ik_live_
Real delivery
Deliver to real recipients through connected clients. Live sends count toward monthly usage and are subject to the trial gate.

A live key can still validate a single send without delivery by setting dry_run: true in the message request.

Apply least-privilege scopes

Create separate keys for separate services. A sender worker usually needs only messages:send; an onboarding service needs the client scopes.

ScopeTypeDescription
clients:readscopeList clients and fetch a client by client_ref.
clients:writescopeCreate WhatsApp and Instagram hosted sessions and complete client onboarding.
messages:sendscopeSend free-form and template messages.
webhooks:readscopeRead webhook configuration and delivery records.
webhooks:writescopeUpdate webhook configuration and redeliver test events.

Manage the key lifecycle

Expire
Choose no expiry, 30 days, 90 days, one year, or a custom timestamp.
Restrict
Attach an IP allowlist when a workload has stable outbound addresses.
Rotate
Issue a replacement secret, deploy it, then retire the previous key.
Revoke
Immediately invalidate a key that is no longer needed or may be exposed.

Read operational headers

Authenticated partner routes return correlation and edge-throttle metadata. The authoritative business throttle is also enforced upstream, so clients should always handle 429 even when the last remaining count was positive.

HeaderTypeDescription
X-Request-IdUUIDCorrelation ID for the request. Include it in support tickets and use it to find the call in Request Logs.
X-RateLimit-LimitintegerCurrent edge-window request ceiling for this key.
X-RateLimit-RemainingintegerRequests remaining in the current edge window.
Retry-AftersecondsPresent on a 429 response. Wait at least this long before retrying.
Response headers
X-Request-Id: 7f438d93-9516-4e91-977d-0d2c78d2ef4c
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 598

# On 429 responses:
Retry-After: 23

Treat the shown limit as runtime metadata, not a permanent plan guarantee. Limits can differ by environment and plan.

Authentication failures

JSON · 401
{
  "error": {
    "code": "unauthorized",
    "message": "Missing or malformed API key. Send `Authorization: Bearer ik_...`."
  }
}
  • 401 — missing, malformed, invalid, expired, or revoked key.
  • 403 — valid key without the scope required by the operation.
  • 402 — trial and grace have ended for a live send. Test and dry-run sends remain available.
  • 429 — request window exhausted; retry after the response delay.

See Errors & debugging for the complete envelope and retry guidance.

PreviousTest in the sandbox
NextClients