> For the complete documentation index, see [llms.txt](https://docs.taqnyat.sa/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.taqnyat.sa/api-reference/api-integration-guide/authentication.md).

# Authentication

The Taqnyat WhatsApp API uses **Bearer Token authentication** to authorize API requests.

Each application created in the Taqnyat portal receives a unique token that must be included in the request header when calling the WhatsApp API.

### Generate a Bearer Token

To generate your API token:

1. Log in to the **Taqnyat Portal**.
2. From the left menu, go to **Developers → Application**.
3. Click **Add**.
4. Enter a name for your application.
5. Select **WhatsApp** as the service for the application.
6. Confirm the application.
7. Copy the generated **Bearer Token**.

The token should be enabled for the WhatsApp service you intend to use.

<figure><img src="/files/HNdoSmcpQ8xdM8dcb1iy" alt=""><figcaption></figcaption></figure>

### Authorization Header

Include the token in the `Authorization` header of every API request.

```
Authorization: Bearer <YOUR_TOKEN>
```

Replace `<YOUR_TOKEN>` with the token generated from your Taqnyat account.

### Example Request

The following example shows how the authentication header is included in an API request:

```
curl --location 'https://api.taqnyat.sa/wa/v2/account/balance/' \
--header 'Authorization: Bearer <YOUR_TOKEN>'
```

> The endpoint above is used only to demonstrate how authentication is included in a request. Individual endpoints are documented separately in the API Reference.

### Request Headers

| Header          | Value                 | Required                   |
| --------------- | --------------------- | -------------------------- |
| `Authorization` | `Bearer <YOUR_TOKEN>` | Yes                        |
| `Content-Type`  | `application/json`    | Required for JSON requests |

### Authentication Error

If the token is missing, incorrect, or invalid, the API may return:

```
HTTP/1.1 401 Unauthorized
```

Verify that:

* The token was copied correctly.
* `Bearer` appears before the token.
* There is a space between `Bearer` and the token.
* The application has access to the WhatsApp service.

### Keep Your Token Secure

Your Bearer Token provides access to your API account.

Do not:

* Include it in public repositories.
* Expose it in client-side applications.
* Share it in screenshots or public documentation.
* Hard-code it in publicly accessible source code.

Store the token securely in your application's environment variables or secret-management system.