Start typing to search the documentation.

↑↓to navigate·↵to open

Guides

Authentication

Sign-in methods for people (password, magic link, OAuth, MFA) and API keys for programs — how to create a key, the API base URL, the auth headers, and a copy-pasteable example.

WRNexus has two kinds of authentication:

  • Interactive sign-in for people using the dashboards (password, magic link, OAuth, MFA) — secured by a session cookie.
  • API keys for programs calling the public API over HTTP — secured by a bearer token.

The first half of this page covers signing in; the second half (API keys) covers everything you need to make your first authenticated API call: creating a key, the base URL, the headers, and a working example.

Email + password

The default method. Passwords are hashed with Argon2id and never stored in plaintext. We enforce a minimum entropy requirement and block passwords found in known breach databases.

Request a one-time sign-in link sent to your email. The link is valid for 15 minutes and can only be used once. Ideal for users who prefer not to manage passwords.

To use magic links, click “Email me a link” on the login page instead of entering your password.

OAuth providers

WRNexus supports social login via:

  • Google — any Google account, including Google Workspace accounts.
  • GitHub — OAuth app linked to your GitHub account.

OAuth logins are automatically linked to an existing WRNexus account if the same email address is already registered.

Multi-factor authentication (MFA)

We recommend enabling at least one MFA method on all accounts.

TOTP (Time-based One-Time Password)

Works with any TOTP-compatible authenticator app (Google Authenticator, Authy, 1Password, etc.):

  1. Go to Account → Security → MFA.
  2. Click Set up authenticator app.
  3. Scan the QR code with your authenticator.
  4. Enter the 6-digit code to confirm.
  5. Save your recovery codes somewhere safe.

WebAuthn / passkeys

Register a hardware security key (YubiKey, etc.) or a platform authenticator (Touch ID, Face ID, Windows Hello):

  1. Go to Account → Security → MFA.
  2. Click Add passkey.
  3. Follow the browser prompt to register your device.

Recovery codes

If you lose access to your MFA device, use one of the 10 recovery codes generated during MFA setup. Each code can only be used once. Regenerate them at any time from Account → Security.

Session management

  • Sessions last 14 days of inactivity, with a hard cap of 90 days.
  • All active sessions are visible under Account → Security → Active sessions.
  • You can revoke any session individually or sign out everywhere.

API keys (programmatic access)

The public WRNexus API (SMS, Email, WhatsApp) is authenticated with an API key — a long-lived bearer token bound to your organization. Unlike the session cookie, an API key is meant to live on a server and is not tied to a browser login.

1. Create an API key

API keys are managed in the Account app:

  1. Sign in at account.wrnexus.com.
  2. Open Developer → API Keys (account.wrnexus.com/api-keys).
  3. Click Create API key and fill in:

    • Name — a label so you can recognise the key later (e.g. production-backend).

    • Scopes — the permissions the key grants. Leave them empty for a full-access key, or restrict to exactly what you need:

      Scope Allows
      sms:send Queue and send SMS messages.
      sms:read Read delivery status, senders, templates, balance.
      email:send Send email.
      email:read Read delivery reports, senders, templates, balance.

    • Expiry — Never, 30 days, 90 days, or 1 year.

  4. Click Create. The full key is shown exactly once, in the form wrn_live_…. Copy it immediately.

Store it now — you can’t see it again. WRNexus stores only a SHA-256 hash of the key, so the plaintext value is unrecoverable after the dialog closes. If you lose it, revoke the key and create a new one.

Network controls (IP allowlist)

On the same API Keys page you can enable an IP allowlist for the organization. When enabled, API calls are only accepted from the IPv4/IPv6 addresses or CIDR ranges you list — requests from anywhere else are rejected with 403 IP_NOT_ALLOWED.

Key storage & security best practices

  • Keep keys server-side. Never commit a key to git or ship it in frontend or mobile code, where it can be extracted.
  • Inject via environment variables / secrets. All SDKs read WRNEXUS_API_KEY from the environment by default — use your platform’s secret manager rather than hard-coding.
  • Scope to the minimum. A send-only script should hold a *:send key, not a full-access one.
  • Rotate regularly. Create the replacement, deploy it, then revoke the old key — a 90-day rotation is a good default.
  • Revoke on exposure. Revoking is instant and permanent; a revoked key is rejected immediately.

2. Base URL

All public API calls go to a single host:

https://app.wrnexus.com

Each product is mounted under its own path on that host:

Product Path prefix Example endpoint
SMS /sms/* https://app.wrnexus.com/sms/send
Email /email/* https://app.wrnexus.com/email/send
Identity /api/me https://app.wrnexus.com/api/me

WhatsApp is different. The WhatsApp Business API is served from https://whatsapp.wrnexus.com/api/whatsapp/* and is authenticated with your WRNexus session cookie, not an API key. See the WhatsApp API page.

3. Passing authentication

Send your API key on every request in one of these headers:

Authorization: Bearer wrn_live_<your_api_key>
X-API-Key: wrn_live_<your_api_key>

Authorization: Bearer is preferred (it is the standards-friendly form and what every SDK uses); X-API-Key is accepted as a convenience for simple integrations. No additional workspace or organization header is required — the key is already bound to an organization, and sends are billed to that organization’s workspace automatically.

A request with no recognised header is rejected before the handler runs:

{
  "code": "UNAUTHENTICATED",
  "message": "Missing API key. Pass it as `Authorization: Bearer <key>` or `X-API-Key: <key>`."
}

4. A basic example

The quickest way to confirm a key works is GET /api/me, which echoes the identity the key resolves to — no scope required.

curl

curl https://app.wrnexus.com/api/me \
  -H "Authorization: Bearer wrn_live_xxx"

Response 200 OK

{
  "keyId": "key_01HVZXXX",
  "name": "production-backend",
  "prefix": "wrn_live_ab12",
  "ownerUserId": "usr_01HVZYYY",
  "organizationId": "org_01HVZZZZ",
  "scopes": ["sms:send", "sms:read"],
  "createdAt": "2026-06-01T09:30:00.000000",
  "lastUsedAt": "2026-06-18T14:05:11.000000",
  "expiresAt": null
}

Once that works, send your first SMS. Every send needs a registered from (sender) and an approved template; message fills a single-placeholder template:

curl https://app.wrnexus.com/sms/send \
  -H "Authorization: Bearer wrn_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "ACMEIN",
    "to": "+919812345678",
    "template": "OTP verify",
    "variables": { "code": "4821" }
  }'
{
  "ok": true,
  "status": "queued",
  "messageId": "f58a2939-2c4b-4f0a-9b7e-1f2a3b4c5d6e",
  "to": "+919812345678",
  "from": "ACMEIN",
  "segments": 1,
  "creditsCost": 1,
  "creditsRemaining": 4821,
  "createdAt": "2026-06-18T14:30:00.000000"
}

The same call with the JavaScript SDK (which reads WRNEXUS_API_KEY from the environment):

import { WrNexusClient } from '@wrnexus/sdk';

const client = new WrNexusClient(); // uses WRNEXUS_API_KEY

const res = await client.sms.send({
  to: '+919812345678',
  from: 'ACMEIN',
  template: 'OTP verify',
  variables: { code: '4821' },
});

console.log(res.messageId, res.status, res.creditsRemaining);

Where to next