> For the complete documentation index, see [llms.txt](https://docs.innopaas.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.innopaas.com/api-reference/api-reference-en/overview/innopaas-api-getting-started-guide.md).

# InnoPaaS API Getting Started Guide

## API Signature Verification Instructions

### Common Request Headers

To ensure API security, all APIs must include security verification request headers,

Authorization and AppKey can only be obtained after creating an AppKey on the InnoPaaS platform

Used for API authentication verification; if verification fails, the API cannot be called and authentication failure is returned.

<table data-header-hidden><thead><tr><th width="97.7890625"></th><th width="142.16796875"></th><th width="111.828125"></th><th width="133.48046875"></th><th></th></tr></thead><tbody><tr><td>No.</td><td>Field</td><td>Data Type</td><td>Required</td><td>Description</td></tr><tr><td>1</td><td>Content-Type</td><td>String</td><td>Yes</td><td>The value is "application/json;charset=utf-8", and the request content is JSON</td></tr><tr><td>2</td><td>AppKey</td><td>String</td><td>Yes</td><td>ApiKey, application access key</td></tr><tr><td>3</td><td>Authorization</td><td>String</td><td>Yes</td><td>Authorization token for application access</td></tr></tbody></table>

**Headers sample code**

```python
headers = {
   'Authorization': 'YUIYIUIAIIASUDIAOSIDUOIWUOQWUEOIUWOEUQWOEUOQWUOUWOUWQOWU',
   'AppKey': 'XFbZY1rtTKo3UD4n1'
   }
```

### Get AppKey

Click the \[Copy] button in the application list to copy the AppKey

<figure><img src="/files/2b12151e4dc0a89cf32020f205d3df9a41da0056" alt=""><figcaption></figcaption></figure>

### Get Authorization

1\. Select an application and get the \[Token] button. Generate the Authorization information required for the app to access the API,**We do not store customers' Token information. Each time a new Token is generated, the previously generated Token will become invalid. If this app's Token is already being used in your production environment, please use this feature with caution. Invalidating the original Token may result in inability to access the API normally.**

<figure><img src="/files/9e9e7e1e7e444e755cec693d13087cf02e2c6c4e" alt=""><figcaption></figcaption></figure>

2\. Generate and copy the Token

* Choose the Token expiration time. By default, it never expires, but you can also specify an expiration date. &#x20;
* Click the \[Create Access Token] button to generate the Token &#x20;
* Click the \[Copy] button to copy the Token

<figure><img src="/files/c455835271598fbc44741ce80c3bbdfd0291298b" alt=""><figcaption></figcaption></figure>

## Configure WebHook callback address

### Configure WebHook events

&#x20; **When pushing template messages, uplink replies, and other signaling events, if the App cannot be recognized or matched, the data will be pushed to the default application; if there is no default application, nothing will be pushed.** &#x20;

1\. In the API Keys function menu list, click the callback event configuration button to start configuration

<figure><img src="/files/27bc07183a8f981d6f2c4d7047ed40fd1d52243e" alt=""><figcaption></figcaption></figure>

2\. Click the \[Add] button to add

<figure><img src="/files/c32c9073a27c03d753e3e819719db61cdf835a43" alt=""><figcaption></figcaption></figure>

3\. Select the product whose WebHook needs to be configured from the available product list

<figure><img src="/files/4483ff1ec170ba18655d56dbddf8cab9f59bf453" alt=""><figcaption></figcaption></figure>

4\. Configure the callback URL and select the events to receive, then click Next to continue

<figure><img src="/files/d57e8d81e69435eabb82896e9b4ac123e1bde27d" alt=""><figcaption></figcaption></figure>

5\. Select the callback request method, default is POST. If the customer's business system needs to verify the signature of the WebHook source, you can configure the UserName and Authorization header information. When the WebHook notification is pushed, UserName and Authorization will be added to the header information, and the customer's configured information will be pushed to the customer's system togethe&#x72;**.**

<figure><img src="/files/daf1a3c034fc831bdd7ee87227833d4628647465" alt=""><figcaption></figcaption></figure>