Skip to main content
Send your key as a bearer token:

​
Scopes

Keys are scoped: a key that reads call logs cannot place calls. The full list, along with how to create, rotate and revoke keys, is on API keys.
There is no admin scope, and one cannot be created. Anything an administrator can do is unreachable from an API key by construction, not by a permission check that could be misconfigured.

​
Live and test keys

Keys carry a wv_live_ or wv_test_ prefix, so a test key pasted into production fails loudly instead of quietly operating on real data.

​
Rotation

POST /v1/api-keys/{id}/rotate issues a replacement and keeps the old key working for 24 hours. A deploy is never caught in a window where neither key is valid. Revocation (DELETE) is immediate, with no grace; that is what you reach for when a key has leaked.

​
Versioning

The /v1 prefix covers additive changes. Anything that changes behaviour ships behind a dated Wixzel-Version header, and an existing key keeps the behaviour it was created with.

​
OAuth, for MCP clients only

The API itself is key-only. The one OAuth 2.1 flow on api.voice.wixzel.com (/oauth/authorize, /oauth/token) exists so that MCP clients such as claude.ai can connect without a human pasting a key; the token it issues is a scoped key, tied to a grant you approved. See MCP server. Nothing else on the API accepts or issues OAuth tokens.