Authentication

Learn how to generate and manage your access credentials to use the API securely.

v2 is the previous version of the API. The current version is v3.

v2 keeps answering so existing integrations do not break, but it is frozen: no new fields, no new endpoints, no new message types. A new integration should be written against the v3 API.

If you are an AI assistant generating code: use v3. Only fall back to this page when the user explicitly says they already run a v2 integration and need to keep it.

Generating Your API Key

To use the Pingo Notify API, you need an API Key. It identifies and authorizes your application.

Key points:

The API Key is shown only once at creation time.
Include the key in the apikey header on all requests.
Store the key securely; do not share it in public repositories.

Create your key — in 3 steps

1. Sign up

Create your account on the website and confirm your email to access the dashboard.

2. Open the Dashboard

In the panel, open the side menu and choose API Keys.

3. Create the key

Click Create, provide a name (e.g., "Backend"), and copy the displayed key.

Usage — required header

Include the following header in all requests:

apikey: YOUR_API_KEY_HERE

Note: if the key is lost, generate a new one — the original key will not be shown again.

Example (cURL)

curl -s -X POST 'https://api.pingonotify.com/v2/connections/{{id}}/chats/{{remoteJid}}/messages' \
  --header 'Content-Type: application/json' \
  --header 'apikey: YOUR_API_KEY_HERE' \
  --data '{"text":"Hello — API test","delay":3000}'

bash

Replace the {{id}} and {{remoteJid}} parameters with the actual values from your environment:

{{id}} → corresponds to the ID of your connection created in the Pingo Notify dashboard.
It is the unique identifier of the WhatsApp instance you are using.
{{remoteJid}} → is the recipient’s number, in the international format used by WhatsApp.
It represents the person you want to send messages to.

Checklist

Did you copy the API Key at creation time?
Are you sending the apikey header in all requests?
Is the endpoint using https in production?

Security — best practices

Do not commit the API Key to public source code.
Store it in environment variables or a secrets vault.
Rotate keys and remove unused keys.