What is an API token?

The API token is a secret key that allows Wapi to authenticate requests to your WordPress site. Each connected site has its own unique token.

Unique token

Your token is a unique and secure key automatically generated

Secure storage

It is stored in an encrypted manner to ensure its security

Automatic connection

Wapi uses a secure authorization system. The token is generated and configured automatically during connection:

In WordPress, go to Wapi > Settings
Click on Connect to Wapi
Authorize the connection on wapigpt.ai
The token is configured automatically - nothing to copy!

Simple and secure

Thanks to our authorization system, you never need to manually handle tokens. Everything is managed automatically and securely.

Technical operation

During connection, the following process occurs automatically:

The plugin redirects to wapigpt.ai with your site URL
You authenticate and authorize access
A temporary authorization code is generated
The plugin exchanges this code for a secure API token
The token is stored encrypted in WordPress

This process ensures that your token is never exposed and only your authorized site can use it.

Regenerate a token

If you think your token has been compromised, you can easily regenerate it:

From WordPress (recommended)

In WordPress, go to Wapi > Settings
Click on Reconnect
Authorize the connection again on wapigpt.ai
A new token is generated and configured automatically

From the SaaS dashboard

Log in to wapigpt.ai
Go to Sites
Click on the concerned site
Click on Regenerate token
Then reconnect from WordPress

Consequences of regeneration

The old token is immediately invalidated

Ongoing requests will fail

Your data and settings are preserved

WU statistics are preserved

Best Practices

Practice	Description
One token per site	Never share a token between multiple sites
Never expose	Do not commit the token to Git, do not send it by email
Periodic regeneration	Regenerate the token every 6 months as a precaution
Monitoring	Regularly check activity logs

Client tokens (Business+)

Business plans and above allow creating client tokens to give limited access to third parties:

Client access

Create tokens with limited permissions for your clients. They can use Wapi via GPT without access to your dashboard.

Create a client token

Go to Sites > [Your site] > Client access
Click on New access
Set a name and optionally an email
A client token is automatically generated

Owner token vs client token differences

Feature	Owner token	Client token
Dashboard access	Yes	No
Permission management	Yes	No
Regeneration	Yes	By the owner
Statistics	Complete	Limited

Security tip

Use a password manager (1Password, Bitwarden, etc.) to store your tokens securely.

Token Management