Security

Security and compliance

Use workspace isolation, key rotation, audit logs, blocked recipients, and SSO safely.

Workspace isolation

Most resources belong to one workspace. API clients, senders, messages, webhooks, contacts, templates, campaigns, automations, team members, and audit logs are scoped by workspace.

Do not pass workspace IDs from browser code as a security boundary. Server-side authorization and session context must decide which workspace is accessible.

Public customer integrations should be server-to-server. Do not enable browser CORS access to API-key send endpoints and do not place `was_...` keys in frontend bundles.

Secret storage examples

Store API keys and webhook secrets in backend environment variables or a secret manager. Never commit them to Git and never print them in logs.

.env

bash

HOOKMESSAGE_BASE_URL=https://api.your-domain.com
HOOKMESSAGE_API_KEY=was_xxx
HOOKMESSAGE_OTP_KEY=was_otp_xxx
HOOKMESSAGE_SENDER_ID=9f4b5d4c-0000-4000-9000-123456789abc
HOOKMESSAGE_WEBHOOK_SECRET=whsec_xxx

Deployment environment examples

Configure the same values in each deployment target. Use separate keys per environment so staging cannot send through production numbers.

deployment-env.sh

bash

# Vercel
vercel env add HOOKMESSAGE_BASE_URL production
vercel env add HOOKMESSAGE_API_KEY production
vercel env add HOOKMESSAGE_SENDER_ID production

# Docker
docker run --env-file .env your-app-image

# Laravel .env
HOOKMESSAGE_BASE_URL=https://api.your-domain.com
HOOKMESSAGE_API_KEY=was_xxx
HOOKMESSAGE_SENDER_ID=9f4b5d4c-0000-4000-9000-123456789abc

Operational controls

Rotate API keys on exposure, revoke unused clients, limit sender assignments, and review audit logs for sensitive actions.

Use blocked recipients to prevent messages to protected numbers. Use SSO on eligible plans when centralized identity is required.

Logging and data handling

Treat API keys, webhook signing secrets, OTP codes, phone numbers, and message contents as sensitive operational data.

For debugging, log request IDs, `message_id`, `sender_id`, status codes, and error codes. Do not log raw API keys, webhook secrets, full OTP codes, or full message bodies.

Need help?

Use Book Integration Help if you want setup help for OTP or automated customer messaging.

Next steps

Quickstart

A practical path from empty workspace to a working server-side integration.

Authentication and access

HookMessage separates customer API keys, dashboard sessions, and internal platform access.

Workspaces

A workspace is the tenant boundary for every customer resource.

Senders and sessions

A sender is the WhatsApp number used to deliver messages for a workspace.