How to connect to the WACRM API and MCP server

The WACRM Core API (api.wacrm.ai/v1) is the same API that the developer portal documents in full, and wacrm-mcp is a small server that wraps five of its calls as tools for an MCP-compatible AI agent. The Core API works today; wacrm-mcp doesn’t ship as an installable package yet, and even once it does, there’s a real gap worth knowing before you start: Workspace’s key-creation screen only offers its original scope checklist, so a handful of the newer WACRM-specific scopes — including every scope wacrm-mcp’s own tools need — aren’t selectable there yet. This tutorial sticks to the calls that actually work with a key minted today, and says plainly where the rest currently stops.

What you need before you start

• A WACRM Workspace account with at least one project (early access — see pricing if you don’t have one yet).
• curl, or any HTTP client that can set a header — nothing else to install for the API part.

Get an API key and make your first call

1. Create an API key. In Workspace, open Developer / API & MCP and create a new key. Choose Secret key (sk_live_…) — server-side for a server or script, or Publishable key (pk_live_…) — browser-safe if the key will ship in browser code, then give it a label you’ll recognize later. Leave “Restrict what this key can do (advanced)” switched off for now — its default scopes already cover both calls below. The new key is shown exactly once, in a “Your new API key” dialog right after you create it, which warns that WACRM stores it hashed and can’t re-send or recover it for you — copy it immediately. The same Developer screen also shows an MCP card marked “Preview” — that’s not a working connector yet, just a preview of what’s coming once wacrm-mcp ships; see “Connect the MCP server” below for what to expect.

   The developer portal documents the same Core API this key calls into — auth, scopes, idempotency and the full endpoint reference:

   

2. Call the health check — no key needed. GET /v1/health is public: it’s the fastest way to confirm you can reach the API before worrying about authentication at all.

   Code Copy

   curl -s https://api.wacrm.ai/v1/health

   Code Copy

   {"status":"ok","version":"1.0.0","database":"ok"}

   

3. Make your first authenticated call. Every authenticated request sends the key as an Authorization: Bearer header. GET /v1/message-templates lists your project’s WhatsApp message templates and needs only templates:read, which is on by default for both a Secret and a Publishable key — so the key from step 1 already works here with no extra scope request.

   Code Copy

   curl -s https://api.wacrm.ai/v1/message-templates \
     -H "Authorization: Bearer sk_live_your_scoped_key"

   Code Copy

   {
     "data": [
       {
         "id": "7e9b9b7a-2f3a-4e36-9a0d-6a2b7a9b7a01",
         "name": "order_confirmation",
         "language": "en",
         "category": "utility",
         "body": "Hi {{1}}, your order #{{2}} is confirmed.",
         "status": "approved",
         "created_at": "2026-10-20T09:00:00+00:00",
         "variant_group_id": null
       }
     ]
   }

Which WACRM API calls can I make today?

A WACRM v1 route checks its required scope on every request, and a handful of scopes aren’t yet offered by Workspace’s key-creation screen — so the honest answer depends on the endpoint, not on your plan:

Rate limits and retries

Two limits are documented today: the AI endpoints (/v1/ai/*) are rate-limited, and POST /v1/messages is capped at 30 requests per minute per key — both answer 429 once hit. A write that should never run twice, like POST /v1/messages, also accepts an Idempotency-Key header: retrying the same request with the same key replays the first response instead of sending again, which is the safe way to retry after a timeout or a dropped connection.

Connect the MCP server to an AI agent

wacrm-mcp isn’t something a WACRM customer can install today. The package lives only inside WACRM’s private repository — there’s no npm package and no public GitHub repo to point to — and a public release is planned, with no date set yet. What follows is the shape your MCP client will use once wacrm-mcp ships, not a connector you can run right now.

Point your MCP client at the server over stdio, with your own scoped key in the environment — the same key shape from step 1 above:

{
  "mcpServers": {
    "wacrm": {
      "command": "node",
      "args": ["/path/to/apps/mcp/src/index.mjs"],
      "env": {
        "WACRM_API_KEY": "sk_live_your_scoped_key",
        "WACRM_API_BASE": "https://api.wacrm.ai"
      }
    }
  }
}

WACRM_API_KEY is the only variable wacrm-mcp requires — the same scoped key from step 1, sent only as an Authorization: Bearer header and never logged or echoed back in a tool result. WACRM_API_BASE defaults to https://api.wacrm.ai and only needs setting to point at a sandbox or a local fake. An account-scoped key (sk_acc_live_...) also needs WACRM_PROJECT_ID, sent as X-WACRM-Project-Id; a project-scoped key (sk_live_...) already implies its project and doesn’t need it.

Once it’s running, a tools/list call will return all five tools — send_template, read_conversation, create_contact, notify_order and wallet_balance — described in full on the wacrm-mcp page.

Ready to try this against your own project? Request early access to get a Workspace, or see pricing first if you’re still comparing plans. For more how-tos like this one, browse the full guides list.