---
title: "Developer Guide"
slug: "developer-guide"
updated: 2026-11-12T08:55:14Z
published: 2026-11-12T08:55:14Z
canonical: "support.whatfix.com/developer-guide"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.whatfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Developer Guide

> [!WARNING]
> Note:
> 
> Whatfix API access is a prerequisite for sending requests to the Whatfix APIs. To enable Whatfix API access, contact [support@whatfix.com](mailto:support@whatfix.com?subject=Request%20to%20enable%20API%20token%20feature&body=Hi%20Whatfix%20Support%20Team%2C%0A%0APlease%20enable%20the%20API%20token%20feature%20for%20my%20account.%0AAccount%20Name%3A%0A%0AThanks%2C%0A).

The Whatfix Application Programming Interface (API) enables you to perform the same operations that are available on the Whatfix web client. Use the Whatfix APIs to access and work with Whatfix data programmatically, without using the Whatfix Dashboard.

For example, you can use the Whatfix APIs to bring Whatfix data into your own data warehouse or Business Intelligence (BI) tool and build reports on top of it.

## How the Whatfix API Works

The Whatfix APIs follow a small set of web standards, so most Hypertext Transfer Protocol (HTTP) clients and programming languages can call them. The Whatfix APIs work in the following ways:

- **REST principles:** Each request acts on a resource, such as an account or its data, using a standard HTTP method.
- **HTTP rules:** Requests and responses follow standard HTTP, so any HTTP client can interact with the Whatfix APIs.
- **Unique resource URLs:** Whatfix exposes every resource as a unique URL, which you can get from the API Root Endpoint.
- **HTTPS only:** Whatfix serves the APIs only over Hypertext Transfer Protocol Secure (HTTPS), which protects your API Token and your data in transit.

## Authentication

Whatfix validates every API request with an API token. Ensure you include your API token in the request header of each API call.

Each Whatfix Dashboard user receives their own API token. The API token identifies the user who makes each request and determines which actions that user can perform on the account.

For more information, see [Generate an API Token](/studio/docs/generatingtheapitoken).

## API Token Security

Keep your API token confidential to prevent unauthorized access to your Whatfix account. Use the following practices to keep your API token secure:

- Store the API token in a secrets manager or an environment variable. Do not store the token in source code.
- Share the API token only with the developers who build the integration, using a secure channel.
- Renew the API token if it is exposed, and then update every integration that uses it.

> [!NOTE]
> Info:
> 
> Whatfix enables you to invalidate and regenerate API tokens to keep them secure. To generate a new API token, click **Renew User API Token.** For more information, see [Generate an API Token](/studio/docs/generatingtheapitoken).![files](https://cdn.document360.io/a268766e-d74d-4619-9613-e2472f809ffb/Images/Documentation/Mirror_Dashboard_Click_Renew_API_Token.png?sv=2026-02-06&spr=https&st=2026-11-14T15%3A13%3A47Z&se=2026-11-14T16%3A13%3A47Z&sr=c&sp=r&sig=WbexRtopAeo8CEftwXBwBii91GcI%2FvJRSZ7B6gSZqaQ%3D)

For more information, see [API Documentation](https://developer.whatfix.com).

The Whatfix Dashboard is where you can perform the following actions:

- Access all content that has been created by users in your organization.
- Access and manage content widgets like Self Help, Pop-ups, Smart tips, Beacons, and Task List
- Manage users
- Manage tags
- Access Analytics
- Manage translations
- Manage Tip or Flow configurations

A unique code that authenticates requests to the Whatfix APIs. Each Whatfix Dashboard user has their own API token, which identifies who is making a request and which actions they can perform.