Getting your page ready…
Authentication & secrets
Keep your Wayo connection safe: API credentials, your signing secret, and how to check that every call really comes from Wayo.
Two credentials, two jobs
Your API key, Bearer token, Basic credentials or OAuth credentials let Wayo access your service. Your Wayo signing secret lets your service verify that the request was signed by Wayo. Neither is your Wayo sign-in password.
Do I need WAYO_SECRET?
| How you connect | Required? |
|---|---|
| SDK Wayo.from_env() / Wayo.fromEnv() | Yes, including REST GET. |
| Existing API without the SDK | Optional. Keep your endpoint’s existing authentication. |
| OpenAI or Claude hosted agent | Use the matching provider key and connection guide. |
| Answer myself or a post | No signing secret needed. |
Find your account’s signing secret in Settings → Developers. Set it on your server, keep it out of frontend code and logs, and restart after changes.
Verifying requests yourself
Wayo signs endpoint requests using Standard Webhooks. Verify the original body for POST or the raw query string without “?” for GET. Parsing and rebuilding JSON before verification changes the signed bytes.
The SDK checks the signature and a five-minute timestamp window. It does not deduplicate requests. Keep inventory lookups read-only and use your normal HTTPS deployment.