API keys

An API key authenticates requests for one account. Its scopes say what it may do; its nickname says what it is for. The plaintext key is shown once, when it is created.

Keys are managed with the api-keys:* scopes. A key you create can only hold scopes you have yourself, and only scopes your account's plan allows: the account, user, API-key, catalog, content and map-view families. Keys for maps, links, kiosks, floor plans, search and directions are issued by your Waygo team.

ENDPOINTS

POST   /auth/v1/api-keys
GET    /auth/v1/api-keys/:key_id
PUT    /auth/v1/api-keys/:key_id
DELETE /auth/v1/api-keys/:key_id

The API key object

Name
key_id
Type
string
Description
The key's ID, used in these endpoints.
Name
nickname
Type
string
Description
What the key is for.
Name
prefix
Type
string
Description
The first characters of the key, to recognise it in logs without storing it.
Name
account_id
Type
string
Description
The account it belongs to.
Name
permissions
Type
string[]
Description
Its scopes, resource:action.
Name
allowed_urls
Type
string[]
Description
The sites the key is intended for. Stored with the key for your records; it does not itself block requests from elsewhere, so a browser key should carry read scopes only.
Name
is_active
Type
boolean
Description
false once revoked.
Name
revoked_at
Type
timestamp | null
Description
When it was revoked.
Name
created_at / updated_at
Type
timestamp
Description
Timestamps.
Name
key
Type
string
Description
The plaintext key. Only in the create response.

The API key object

{
  "key_id": "hSIhXBhNe8X1d8Et",
  "nickname": "Exhibitor sync",
  "prefix": "wg_live_hS",
  "account_id": "dash-dev-acct",
  "permissions": ["catalogs:read", "catalogs:write", "content:read", "content:write"],
  "allowed_urls": [],
  "is_active": true,
  "revoked_at": null,
  "created_at": "2026-09-18T19:44:21",
  "updated_at": "2026-09-18T19:44:21"
}

POST/auth/v1/api-keys

Create an API key

Body

Name
nickname
Type
string
Description
Default Unnamed API key.
Name
permissions
Type
string[]
Description
The scopes. Default [] (a key that can do nothing).
Name
allowed_urls
Type
string[]
Description
Default [].

The response is the only time key is returned in plaintext. Store it in your secrets manager; keep key_id and prefix to identify it later.

POST /auth/v1/api-keys

API KEY SCOPE

api-keys:write

curl -X POST https://api.waygomaps.com/auth/v1/api-keys \
  -H "Waygo-API-Key: $WAYGO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "nickname": "Exhibitor sync",
    "permissions": ["catalogs:read", "catalogs:write", "content:read", "content:write"]
  }'

Response (201)

{
  "key": "wg_live_hSIhXBhNe8X1d8Et…",
  "key_id": "hSIhXBhNe8X1d8Et",
  "nickname": "Exhibitor sync",
  "prefix": "wg_live_hS",
  "account_id": "dash-dev-acct",
  "permissions": ["catalogs:read", "catalogs:write", "content:read", "content:write"],
  "allowed_urls": [],
  "is_active": true,
  "revoked_at": null,
  "created_at": "2026-09-18T19:44:21",
  "updated_at": "2026-09-18T19:44:21"
}

GET/auth/v1/api-keys/:key_id

Retrieve an API key

The key object, without the plaintext key.

GET /auth/v1/api-keys/:key_id

API KEY SCOPE

api-keys:read

curl https://api.waygomaps.com/auth/v1/api-keys/hSIhXBhNe8X1d8Et \
  -H "Waygo-API-Key: $WAYGO_API_KEY"

PUT/auth/v1/api-keys/:key_id

Update an API key

Rename a key or change its allowed_urls. Scopes cannot change: create a new key with the scopes you need and revoke the old one.

PUT /auth/v1/api-keys/:key_id

API KEY SCOPE

api-keys:write

curl -X PUT https://api.waygomaps.com/auth/v1/api-keys/hSIhXBhNe8X1d8Et \
  -H "Waygo-API-Key: $WAYGO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "nickname": "Exhibitor sync (nightly job)" }'

DELETE/auth/v1/api-keys/:key_id

Revoke an API key

The key stops working immediately and stays listed as inactive.

DELETE /auth/v1/api-keys/:key_id

API KEY SCOPE

api-keys:delete

curl -X DELETE https://api.waygomaps.com/auth/v1/api-keys/hSIhXBhNe8X1d8Et \
  -H "Waygo-API-Key: $WAYGO_API_KEY"

Response

204 No Content