API keys: permissions, channels, IPs, lifetime, and replacing keys.
Every API v2 request carries one API key in the Authorization: Bearer header. Klik Flow stores only the key's fingerprint, so a lost key cannot be shown again: replace the key.
Live keys and test keys
kf_live_…: sends for real and uses the plan's message quota. Needs a plan with the API feature.kf_test_…: sends only to test numbers, with its own limits (60 requests per minute, 100 messages per day). Can be created on every plan. See the Test mode guide.- The
Klikflow-Modeheader in every response holdsliveortest, so your system can confirm which key is installed.
Key permissions
Choose only the permissions you need when you create the key. Each permission must also be held by the key creator's role when the request comes in: if the role is changed, the key narrows with it. The permission each endpoint needs is listed on its reference page.
business:read: business and channels.contacts:read,contacts:write: contacts and custom fields.conversations:read: conversations and message content, limited to the chats the key's creator can see.messages:send: send messages and reply to conversations.messages:new: start WhatsApp (scan QR) chats to new numbers.templates:read,templates:write: WhatsApp Official templates.webhooks:manage: webhooks to your system, live keys only.
Channels and IPs
A key can be limited to specific WhatsApp numbers; without a limit, the key uses every number its creator may use. Also fill in the server IPs allowed to use the key: IPv4/IPv6 addresses or IPv4 ranges such as 198.51.100.0/24. Requests from other IPs are refused with ip_not_allowed.
Lifetime
Choose until revoked, 30 days, 90 days, or 1 year. Expired keys are refused with key_expired; the date appears in the key list.
Replacing a key
Press Replace (Ganti) on the key. A new key is created with the same permissions, channels, IPs, and lifetime, while the old key keeps working for the grace period you choose (stop immediately, 24 hours, 3 days, or 7 days). Install the new key on your server within that period. Revoke (Cabut) stops a key at once, including its grace period.
Storing keys
Keep keys in environment variables or the server's secret store. Do not put them in a mobile app, web page code, or a repository. Call the API from your server; the API does not accept calls straight from a browser.