Agento AI by WebCore Studio Authentication Documentation
Every programmatic interaction with Agento AI is authenticated and scoped to an isolated business tenant using cryptographic credentials or multi-tenant session tokens.
1. Bearer Token & Tenant Headers
Include one of the following authentication headers with every REST API request:
# Option A: Standard Bearer Token
Authorization: Bearer <YOUR_API_TOKEN>
# Option B: Business Tenant Header
x-business-id: 6f1a3fde-f8fc-4ff0-b9ae-05969d2594e9
2. WhatsApp Inbound Webhook Verification
Inbound webhook events delivered from Meta WhatsApp Cloud API are verified against the raw request body using HMAC-SHA256:
Header: x-hub-signature-256: sha256=<HASH>
Secret: Processed against configured WHATSAPP_APP_SECRET
3. Background Job & Cron Authentication
Background automation scan triggers require the shared cron secret in request headers:
Header: x-cron-secret: <YOUR_CRON_SECRET>