Developers

Authentication

The API recognises three kinds of caller: signed-in agents, installed apps, and anonymous website visitors. Which one you are decides how you authenticate.

Bearer tokens (agents & apps)

Authenticated endpoints expect an Authorization header. The token identifies your organization and role, and the API scopes every response to it.

Authorization: Bearer YOUR_TOKEN

A token is granted when an agent signs in, and — for third-party integrations — when a workspace installs your OAuth app. Admin-only endpoints (creating webhooks, routing rules, bans, etc.) require a token whose role is admin or higher.

Same-origin from the appFirst-party requests made from inside the EveryChan app send the session cookie automatically, so you rarely set the header yourself there. You need an explicit bearer token for server-to-server calls.

Visitor tokens (widget)

Website visitors are anonymous. The widget calls a public endpoint to mint a short-lived visitor session token, which then authorises the chat WebSocket. No secret is involved — it is safe to run in the browser.

POST /api/visitors/get_token
Content-Type: application/json

{ "workspaceId": "YOUR_WORKSPACE_ID" }

See Widget & JS API for the full flow.

Scopes

App tokens are limited to the scopes granted at install time. Request only what you need:

Scope	Grants
`workspace:read`	Workspace details
`chats:read`	Read conversations & messages
`chats:write`	Send messages
`contacts:read`	Read contacts
`contacts:write`	Create / update contacts
`calls:read`	Read calls
`webhooks:manage`	Create & delete webhooks

Authentication

Bearer tokens (agents & apps)

Visitor tokens (widget)

Scopes

Your privacy matters to us