unauthorized — Missing or invalid token
What the API returns
{
"error": {
"code": "unauthorized",
"message": "Missing or invalid channel token.",
"request_id": "req_01JRQ8F4X9N2K7YB3C5V6W8H0T"
}
}Every Wapito error is this one envelope. Branch on code, which is stable; message is written for people and can be reworded; details appears only when there is something specific to say; request_id is what to quote to support.
What it means
unauthorized is an HTTP 401 error from the Wapito WhatsApp API: missing or invalid token. The response message reads “Missing or invalid channel token.” It is not retryable: the same request fails again until you change it. 5 endpoints can raise it, GET /channel among them.
Why it happens
Every call needs an Authorization header carrying the channel token as a bearer credential. This status means the header was absent, was not in bearer form, or held a token that does not match any live channel. It is also what you get when a token from one environment is pointed at another, because tokens are bound to a single channel and never work across channels.
How to fix unauthorized
Send the header exactly as Authorization: Bearer wpt_... with a single space and no quotes around the token.
Confirm you are using the channel token from the dashboard, not the Firebase user id token used by the web app.
If the token was copied through a shell or a spreadsheet, check for a trailing newline or a smart quote that was pasted with it.
The same failure in other stacks
If you are moving from a library or a self-hosted gateway, this is the same failure under the name that stack gives it:
not-authorized
Endpoints that raise it
Where you will meet it
- Connect a Number
Feature guide
Retry guidance
Do not retry as sent
The same request fails the same way until something changes: the body, the credential, the recipient or the state of the channel. Keep it off every retry loop, fix the cause above, and send a corrected request once.
Frequently asked questions
Is unauthorized different from token_revoked?
Yes, and the difference matters. unauthorized means the credential presented is not recognised at all, usually a typo or a missing header. token_revoked means the token was real and has been deliberately retired, so the fix is to rotate it in the dashboard and redeploy rather than to hunt for a header bug.
Can I put the token in a query parameter instead?
No. Tokens only travel in the Authorization header, because query strings end up in server logs, browser history and referrer headers. The one exception is a signed media link, which carries its own short-lived signature instead of the token.
Related
Try it on your own number
Create a channel, link a WhatsApp number by QR or pairing code, and call the API in a couple of minutes. The Sandbox plan is free and needs no card.