Integration guide
The REST API authenticates with a per-organization API token, sent as a bearer token in the Authorization header. The same token manages webhooks. ReplyBox resolves your organization from the token — you never pass an organization ID to the public API.
Settings → Developers → API Token
api:manage
Formatrb_live_ followed by a random string
401 Unauthorized — missing, invalid, or revoked
Revoke
401
Token lifecycle
Sign in to the ReplyBox dashboard, open Settings → Developers → API Token, click Generate Token, and name it (e.g. crm-sync).
The token is shown only once. Copy it straight into a secrets manager or environment variable.
Send it as Authorization: Bearer … on REST API and webhook management calls.
Delete it from the same API Token screen. It stops working immediately.
If a token is lost, revoke it and generate a new one.
Sending the token
All requests are made to the base URL below, use JSON (Content-Type: application/json), and must be made over HTTPS. If your workspace uses a custom API domain, replace the host with the one provided to you. Every path is relative to /api/v1.
https://api.replybox.utopiagroup.com.my/api/v1Authorization: Bearer rb_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxcurl -X POST https://api.replybox.utopiagroup.com.my/api/v1/public/messages \
-H "Authorization: Bearer $REPLYBOX_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "channelId": "<CHANNEL_ID>", "to": "60123456789",
"message_type": "text", "body": { "text": "Hello from the API!" } }'What a token can do
A token can send messages and read data for your workspace, and manage its webhooks. Full request and response details are in the Public API guide and the Webhooks guide.
Send
/public/messages
POST/public/channel-targets/{targetId}/posts
Read
/public/contacts
GET/public/contacts/{phone}
GET/public/tags
Manage
/public/webhooks
GET/public/webhooks
PATCH/public/webhooks/{webhook_id}
DELETE/public/webhooks/{webhook_id}
Security risk
An API token is as sensitive as a password. Anyone who has it can use the API permissions granted to that token, including reading workspace data and sending messages.
Do
.env and .env.local to .gitignore before giving a coding agent access to the project.
If you lose it, revoke it and generate a new one.
Never
Working with a coding agent? Tell it to store the API token in a local environment variable. It must never print it, log it, put it in source code, or commit it, and it should check that .env and .env.local are in .gitignore.
Don't mix them up
Both are shown once, but they do different jobs. The token authenticates your calls to ReplyBox; the webhook secret lets you verify calls ReplyBox makes to your endpoint.
rb_live_…
You → ReplyBox. Sent as Authorization: Bearer. Shown once when generated; revoke and regenerate from API Token.
whsec_…
ReplyBox → You. Signs each delivery (HMAC-SHA256). Returned only when the webhook is created; not rotated by update — create a new webhook for a new secret.
Getting 401 Unauthorized?
Still stuck? Contact support@utopiagroup.com.my (or your ReplyBox account manager) and include your organization name.
Authorization header missing?
Is the token invalid or mistyped?
Was the token revoked?