Console

Sign staff in to the inbox

.md

POST

https://whatsapp.paaltech.org/api/v1/businesses/{external_id}/inbox/sign-in

Token ability: inbox.manage · Authentication

Single sign-on into the PaalChat inbox for a staff member already signed in to your product. Send who they are and their role (admin, agent or viewer) - PaalChat records or updates the member - then redirect their browser to url. The link works once, within 5 minutes; ask for a new one each time. Pass conversation_id to open that conversation. PaalChat never holds staff passwords. Needs the inbox enabled for the business.

Path parameters

external_id string required

Your own ID for the business (Multi-SKUUL - the tenant ID).

Max 191 characters. Pattern ^[A-Za-z0-9._:-]+$.

Body parameters

staff object required

external_id string required staff.external_id

Your id for the staff member.

Max 191 characters.

name string required staff.name

Max 191 characters.

email string | null staff.email

Format email.

role string required staff.role

viewer reads; agent also replies, notes, tags and takes conversations; admin also assigns anyone.

One of: admin, agent, viewer.

conversation_id integer | null

Open this conversation after signing in.

Responses

201

The one-time link.

401

unauthenticated - missing, invalid, revoked or expired token

403

missing_ability, or feature_disabled (the inbox is not enabled for the business).

404

not_found - not yours, or does not exist

409

business_suspended.

422

validation_failed - fields are invalid; see errors.

429

rate_limited - over 300 requests/minute for this product

Errors always look like {"error": {"code", "message"}} - see Errors and status codes.

Language

Credentials

Authorization Bearer $PAALCHAT_TOKEN

Request

cURL

curl --request POST \
  --url 'https://whatsapp.paaltech.org/api/v1/businesses/presec/inbox/sign-in' \
  --header "Authorization: Bearer $PAALCHAT_TOKEN" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
  "staff": {
    "external_id": "teacher-12",
    "name": "Kwame Owusu",
    "email": "owusu@presec.edu.gh",
    "role": "agent"
  },
  "conversation_id": 7
}'

const response = await fetch('https://whatsapp.paaltech.org/api/v1/businesses/presec/inbox/sign-in', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.PAALCHAT_TOKEN}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "staff": {
      "external_id": "teacher-12",
      "name": "Kwame Owusu",
      "email": "owusu@presec.edu.gh",
      "role": "agent"
    },
    "conversation_id": 7
  }),
});

const data = await response.json();
console.log(response.status, data);

use Illuminate\Support\Facades\Http;

$response = Http::withToken(env('PAALCHAT_TOKEN'))
    ->acceptJson()
    ->post('https://whatsapp.paaltech.org/api/v1/businesses/presec/inbox/sign-in', [
        'staff' => [
            'external_id' => 'teacher-12',
            'name' => 'Kwame Owusu',
            'email' => 'owusu@presec.edu.gh',
            'role' => 'agent',
        ],
        'conversation_id' => 7,
    ]);

$data = $response->json();

import os
import requests

response = requests.post(
    "https://whatsapp.paaltech.org/api/v1/businesses/presec/inbox/sign-in",
    headers={"Authorization": f"Bearer {os.environ['PAALCHAT_TOKEN']}", "Accept": "application/json"},
    json={
        "staff": {
            "external_id": "teacher-12",
            "name": "Kwame Owusu",
            "email": "owusu@presec.edu.gh",
            "role": "agent",
        },
        "conversation_id": 7,
    },
)

print(response.status_code, response.json())

require 'net/http'
require 'json'

uri = URI('https://whatsapp.paaltech.org/api/v1/businesses/presec/inbox/sign-in')
request = Net::HTTP::Post.new(uri)
request['Authorization'] = "Bearer #{ENV['PAALCHAT_TOKEN']}"
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~JSON
  {
    "staff": {
      "external_id": "teacher-12",
      "name": "Kwame Owusu",
      "email": "owusu@presec.edu.gh",
      "role": "agent"
    },
    "conversation_id": 7
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }
puts response.code, JSON.parse(response.body)

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
)

func main() {
	req, err := http.NewRequest("POST", "https://whatsapp.paaltech.org/api/v1/businesses/presec/inbox/sign-in", strings.NewReader(`{
  "staff": {
    "external_id": "teacher-12",
    "name": "Kwame Owusu",
    "email": "owusu@presec.edu.gh",
    "role": "agent"
  },
  "conversation_id": 7
}`))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("PAALCHAT_TOKEN"))
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.StatusCode, string(out))
}

Try it with a test key

Only sk_test_ keys: requests reach your sandbox businesses, never real ones. The key is not saved.

Test key

external_id

JSON body

Response

Response

{
  "data": {
    "url": "https://whatsapp.paaltech.org/inbox/sign-in/Xk3...64 chars",
    "expires_at": "2026-10-02T09:05:00+00:00",
    "member": {
      "external_id": "teacher-12",
      "name": "Kwame Owusu",
      "email": "owusu@presec.edu.gh",
      "role": "agent",
      "active": true,
      "last_seen_at": null
    }
  }
}

{
  "error": {"code": "unauthenticated", "message": "A valid product token is required."}
}

{"error": {"code": "not_found", "message": "Business not found."}}

{
  "error": {
    "code": "validation_failed",
    "message": "The external id field format is invalid. (and 1 more error)"
  },
  "errors": {
    "external_id": ["The external id field format is invalid."],
    "name": ["The name field is required."]
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Slow down and retry after the Retry-After header."
  }
}