Authentication

The Weave Public API uses API Tokens for authentication. Every request must include a valid API Token and a location identifier in the request headers.

Obtaining a token

API Tokens are not self-serve. To get one, reach out to your Weave support representative. They will issue a token scoped to the Weave locations your account has access to.

Required headers

By default, every API request must include both of the following headers:

  • Authorization: Bearer <token> - your API Token.
  • Location-Id: <location-id> - the ID of the Weave location the request is acting on behalf of. The location must be one your token has access to.

Individual endpoints may not require Location-Id. Check the documentation for specific API endpoints for more information.

Example:

POST /analytics/v1/smsMessages:search HTTP/1.1
Host: public.weave-api.com
Authorization: Bearer eyJhbGci...
Location-Id: f15ea08d-d31c-433c-a6f7-7c957bcaa619

Errors

Requests with a missing or invalid token, or with a Location-Id that is absent or not accessible to the token, will receive a 401 Unauthorized response.

Security

API Tokens grant access to your Weave location data. Treat them like passwords:

  • Do not commit tokens to source control.
  • Do not share tokens in public channels or issue trackers.
  • If a token is compromised, contact your Weave support representative immediately to have it revoked and reissued.