Skip to main content
Every request to the Wave API is authenticated with an API key sent in the X-API-Key header. Keys are issued from the Wave Console, per partner — this guide walks through creating one, storing its value, and managing the keys a partner already has.

​
Create a key

  1. In the Wave Console, open Parceiros and select the partner the key will act on behalf of.
  2. Go to the Configurações tab and open Segurança & Acesso. The Chaves de API card lists every key already issued for that partner.
  3. Click + to open the Criar chave de API dialog.
Chaves de API card listing the partner's keys, with the + button and a row's ... menu open
  1. Fill in the new key:
    • Nome da chave — a descriptive name that identifies where the key is used (for example, Integração ERP — produção). It is only a label, so it can be changed later.
    • Permissões — pick Acesso completo to grant every permission available to the partner, or Apenas permissões selecionadas to grant only the ones you check. Grant the narrowest set the integration needs — permissions are fixed once the key is created.
    • Sem expiração — leave it on for a key that stays valid until it is revoked manually. Turn it off to have the key expire on a date you choose.
Criar chave de API dialog with the name field, permission options, and expiration toggle
  1. Click Criar. The new key appears at the top of the list, flagged Nova, with its value shown in full — it starts with the wave_api_ prefix.
  2. Copy the value with the copy button next to it and store it in your secret manager before leaving the page.
Newly created key showing its full value, the copy button, and the notice that the value is displayed only once
The key value is shown only once, right after it is created. Once you navigate away, there is no way to display it again — if you lose it, create a new key and revoke the old one.

​
Use the key

Send the value as the X-API-Key header on every request:
See Authentication for the full header reference, including how to scope a request to a single broker.

​
Manage existing keys

Every key in the Chaves de API list shows when it was created, when it was last used (Ainda não utilizada until the first request comes in), and how many permissions it carries. The … menu on each row has two actions:
  • Editar — rename the key. Only the name can be changed; to grant or remove permissions, create a new key with the permissions you need and revoke the old one.
  • Revogar — invalidate the key immediately. Requests still sending it start failing with 401 Unauthorized. Revoking cannot be undone; issue a new key to restore access.
Issue one key per integration instead of sharing a single key across systems. If one of them leaks, you can revoke just that key without taking the others down.
Having trouble generating or using an API key? Contact us through our support portal.