Authentication

Authorization: Bearer ta_live_…

Create a key in Settings → API keys. It is shown once, at creation, and stored only as a hash — nothing can retrieve it afterwards, including us.

Your public key (pk_…) identifies which agent answers and is meant to be visible in your page source.Your API key (ta_live_…) can message any of your customers. It belongs in a server’s environment. Putting it in your HTML hands anybody the ability to message your entire contact list.

Revoking

Immediate. Revoked keys are kept along with their last-used time, because that is the first thing anybody wants to know after a leak.

Rate limits

Per organization, per minute.

HTTP/1.1 429 Too Many Requests
Retry-After: 60

Honour Retry-After. The limit exists because a loop in an integration can spend a month of WhatsApp budget before anybody looks at a dashboard — and because Meta rate-limits the number afterwards. The damage is money first and reputation second.

Idempotency protects you from repeating one request. It does nothing about a thousand different ones. These are separate problems and both are guarded.

Storing the key

THINNEST_API_KEY=ta_live_xxxxxxxxxxxx

const res = await fetch("https://app.thinnest.ai/api/v1/messages", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.THINNEST_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
});

import os, requests

res = requests.post(
    "https://app.thinnest.ai/api/v1/messages",
    headers={"Authorization": f"Bearer {os.environ['THINNEST_API_KEY']}"},
    json=payload,
)

API reference

This is not your widget key

Revoking

Rate limits

Storing the key

​This is not your widget key

​Revoking

​Rate limits

​Storing the key

This is not your widget key

Revoking

Rate limits

Storing the key