Sikio API · v1

Authentication and API keys

Every integration request uses HTTP Basic authentication over HTTPS: the API key is the username and the API secret is the password.

Replace the two credential placeholders in this standalone request:

curl --fail-with-body \
  --user 'YOUR_API_KEY:YOUR_API_SECRET' \
  --write-out '\nHTTP %{http_code}\n' \
  'https://stage.api.ictlife.com/v1/integrations/whatsapp/channels'

const credentials = Buffer.from('YOUR_API_KEY:YOUR_API_SECRET').toString('base64');
const response = await fetch("https://stage.api.ictlife.com/v1/integrations/whatsapp/channels", {
  method: 'GET',
  headers: {
    Authorization: 'Basic ' + credentials,
  },
});
const text = await response.text();
if (!response.ok) throw new Error(`HTTP ${response.status}: ${text}`);
console.log(response.status, text ? JSON.parse(text) : null);

import base64, json
import urllib.request, urllib.error
credentials = base64.b64encode(b'YOUR_API_KEY:YOUR_API_SECRET').decode()
headers = {'Authorization': 'Basic ' + credentials}
request = urllib.request.Request("https://stage.api.ictlife.com/v1/integrations/whatsapp/channels", method='GET', headers=headers)
try:
    with urllib.request.urlopen(request, timeout=30) as response:
        text = response.read().decode()
        print(response.status, json.loads(text) if text else None)
except urllib.error.HTTPError as error:
    raise SystemExit(f'HTTP {error.code}: {error.read().decode()}')

Environments

Requests include the complete URL. Change the hostname to match your environment; keep /v1 in the path. In the downloadable OpenAPI file, servers already include /v1. Use separate keys and test data for each environment.

Permissions

Create one key per integration and grant only the permissions needed. Existing legacy keys do not automatically gain integration permissions. Contacts permissions do not grant WhatsApp access.

Workspace boundaries

The API derives the workspace from the credential. Public integration requests do not accept a workspace or group_id selector. WhatsApp permissions cover eligible native channels in that workspace; per-channel key restrictions are not available in this version.

Run examples privately

Use a private directory accessible only to your account (directory permissions 700). Restrict saved request files to owner read/write access, for example chmod 600 request.mjs or chmod 600 request.py. Disable your shell’s history recording before pasting commands containing real credentials. Remove temporary request files after testing. In your application, load credentials from your server’s secret store instead of keeping them in source files.

Secrets, revocation and rotation

Keep credentials on your server. Do not embed them in browser JavaScript, mobile apps, source control or support screenshots. A workspace administrator manages keys under Integrations → API keys; the legacy Settings → API keys link also remains available.

Revocation stops the integration. Rotation creates a new idempotency namespace: a new credential cannot retrieve the old credential’s requests or deduplicate its sends. Reconcile processing or uncertain sends before rotating, and retain request IDs for administrator-assisted investigation.