Access Tokens

A personal access token (oc_live_…) is a long-lived credential that lets the splashify CLI act on your Splashify Pro account. The Splashify OpenClaw skill uses the same token, since it runs the CLI under the hood — connect once, and both work.

What a token can do

• It works as an alternative to your normal login on every app action — messaging, contacts, broadcasts, templates, analytics, and more.
• It always acts as you (the account owner), scoped to your account.
• It never grants admin or reseller access.
• By default it is unscoped, meaning it can do everything the account owner can. Use scopes to narrow it — essential before handing a token to a third-party integrator.

Treat a token like a password.

Scopes

A token created without a scopes array is unscoped — full account access, including deleting your WhatsApp Business Account. That is fine for your own laptop and wrong for anything you hand to someone else.

Pass scopes to narrow it:

curl -X POST https://api.splashifypro.com/api/v1/public/../app/developer/access-tokens \
  -H "Authorization: Bearer $SPLASHIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "AutoTally integration",
        "scopes": ["messages:send", "contacts:read"],
        "expires_in_days": 90
      }'

The response always echoes what was granted, so you never have to infer it:

{
  "success":     true,
  "id":          "…",
  "token":       "oc_live_…",
  "scopes":      ["contacts:read", "messages:send"],
  "full_access": false,
  "expires_at":  "2026-11-12T09:30:00Z"
}

Fetch the catalogue at any time — it is the authoritative list:

GET /api/v1/app/developer/access-token-scopes

Rules worth knowing:

• :write implies :read on the same resource. contacts:write covers contacts:read.
• messages:send does not imply messages:read. A send-only token cannot read your conversation history — that separation is the point.
• An unknown scope is rejected with a 400, never silently dropped. Dropping it would leave the list empty, and an empty list means full access — the opposite of what you asked for.
• A request outside the token's scopes returns 403 with code: "insufficient_scope" and the required_scope.
• Tokens created before scopes existed remain unscoped and keep working.

Create a token — in the app

1. Open Settings → Developer → Access Tokens & OpenClaw.
2. Click New Token.
3. Enter a name — this is now required.
4. Optionally set Expires in (days). If you omit it the token expires in 90 days; pass 0 to make it never expire (you will get a warning field back saying so).
5. Click Create Token and copy the value immediately.

The API rejects unknown fields with a 400. If you send a field we do not recognise you will hear about it, rather than having it silently ignored.

The full token is shown once. Only a short prefix (oc_live_……) is stored for display afterwards — you cannot retrieve the full value again.

Create a token — from the CLI

Once the CLI is connected, you can mint more tokens without the app:

splashify token create --name "Server automation"
splashify token create --name "Temp token" --expires-days 30

List your tokens

In the app: the Access Tokens panel lists each token with its name, prefix, creation date, and last-used time.

From the CLI:

splashify token list

ID                                    NAME              PREFIX         LAST USED     STATUS
2f1c…                                  OpenClaw laptop   oc_live_a1b2c  May 19, 2026  active

Revoke a token

Revocation is immediate — the moment a token is revoked, the CLI and the OpenClaw skill that depend on it stop working.

In the app: click Revoke next to the token, then confirm.

From the CLI:

splashify token revoke <id>

Security best practices

• Create a separate token per device or integration, so you can revoke one without affecting others.
• Set an expiry for short-lived or experimental use.
• The CLI stores the token at ~/.splashify/config.json with 0600 permissions — keep that file private.
• Revoke any token you no longer use.
• There is a limit of 20 active tokens per account; revoke old ones to create new ones.

Next

• Install the CLI
• Commands
• OpenClaw skill