Browse documentation

Authentication

How the notification endpoint identifies your workspace.

MsgOrb exposes two public HTTP endpoints for WhatsApp Automation. Everything else in the product is a server action behind the dashboard session and is not callable from outside.

EndpointAuthentication
POST /api/webhooks/ingestx-api-key header
POST /api/groups/registerNone. The org_id and group_id in the body must match each other

The API key

Each workspace has one webhook API key. Find it on any Notification page — Appointment, Delivery or Status Update — under Authentication. Reveal it with the eye button.

Keys are prefixed whk_. Send it as a header on every request:

x-api-key: YOUR_API_KEY

The key identifies the workspace. MsgOrb resolves your organisation from the key alone and never trusts an organisation id in the request body.

Rotating

Regenerate on the Authentication panel issues a new key and invalidates the old one immediately. Update every integration before you rotate. Owner only.

Treat the key like a password. Anyone holding it can send WhatsApp messages from your business number. Store it in your integration's secret store, not in client-side code, and never in a public repository.

Base URL

https://msgorb.com

The Notification pages show the base URL your workspace is configured with. Copy the endpoint from there rather than assembling it by hand.