Access token and API base URL

The Hadir Chat API lets your own systems read and change data in your workspace: contacts, conversations, messages and more. Every request needs three things: the base URL, your workspace ID and your access token.

The base URL

All API requests go to:

https://app.hadir.chat/api/v1/accounts/{account_id}/…

Requests and responses are JSON. Send Content-Type: application/json with every request that has a body.

Find your workspace ID

1. Open your inbox in the browser.
2. Look at the address bar. The part after /app/accounts/ is your workspace ID, for example acc_7Hk2mPq9RtWx.
3. Use that value in place of {account_id}.

The API accepts this ID (it starts with acc_). Older integrations that use the workspace's numeric ID keep working too, but new code should use the acc_ ID, because it is the one the dashboard shows.

Copy your access token

1. Select your profile picture at the bottom of the side menu, then Profile settings.
2. Scroll to Access Token (1).
3. Select Copy (2) and store the token somewhere safe on your server, such as an environment variable.

Send the token with each request

Put the token in a header named api_access_token:

curl https://app.hadir.chat/api/v1/accounts/acc_7Hk2mPq9RtWx/inboxes \
  -H "api_access_token: YOUR_ACCESS_TOKEN"

If the token is correct you get a list of your channels. If not, you get 401 with {"error": "Invalid Access Token"}.

What the token can do

• The token belongs to you, not to the workspace. Every request acts as you, with your role's permissions. An agent's token cannot do what only an administrator can, such as adding agents, teams or webhooks.
• If you belong to more than one workspace, the same token works in each, using the workspace ID in the URL.
• If your plan does not include the API, requests answer 402 with "error_code": "feature_not_in_plan".

Reset the token

If you think the token has leaked, select Reset next to it, then select it again to confirm. A new token is issued and the old one stops working at once, so update every system that uses it.

Note: anyone with your token can act as you in your workspace. Never put it in a web page, a mobile app or a public code repository. Keep it on your server only.

Next: the API reference and webhooks.