Environment
WAHA version: 2026.8.2
Engine: WEBJS
Tier: CORE
Platform: linux/x64
Installed via: Docker (devlikeapro/waha)
Description
When WAHA_API_KEY and WHATSAPP_SWAGGER_USERNAME are both configured, the dashboard sends the value of WHATSAPP_SWAGGER_USERNAME as the x-api-key request header instead of WAHA_API_KEY. This causes all dashboard API requests to return 401 Unauthorized.
Steps to Reproduce
Run WAHA Core with the following environment variables set:
WAHA_API_KEY=<some_key>
WHATSAPP_SWAGGER_USERNAME=admin
WHATSAPP_SWAGGER_PASSWORD=<some_password>
Open the dashboard in a browser
Complete Basic Auth login with WHATSAPP_SWAGGER_USERNAME / WHATSAPP_SWAGGER_PASSWORD
Open browser DevTools → Network tab
Inspect the request headers of any API call made by the dashboard (e.g. GET /api/sessions)
Expected Behavior
The dashboard should send the value of WAHA_API_KEY in the x-api-key header.
Actual Behavior
The x-api-key header contains the value of WHATSAPP_SWAGGER_USERNAME instead of WAHA_API_KEY:
x-api-key: admin
This causes all dashboard requests to return 401 Unauthorized when WAHA_API_KEY !== WHATSAPP_SWAGGER_USERNAME.
Workaround
Set WAHA_API_KEY to the same value as WHATSAPP_SWAGGER_USERNAME:
WAHA_API_KEY=admin
WHATSAPP_SWAGGER_USERNAME=admin
This is obviously not ideal from a security standpoint, as it forces the API key to be a predictable value.
Additional Notes
The API itself works correctly — requests made directly with curl using the proper X-Api-Key header are authenticated successfully. The issue is isolated to the dashboard frontend.
Environment
WAHA version: 2026.8.2
Engine: WEBJS
Tier: CORE
Platform: linux/x64
Installed via: Docker (devlikeapro/waha)
Description
When WAHA_API_KEY and WHATSAPP_SWAGGER_USERNAME are both configured, the dashboard sends the value of WHATSAPP_SWAGGER_USERNAME as the x-api-key request header instead of WAHA_API_KEY. This causes all dashboard API requests to return 401 Unauthorized.
Steps to Reproduce
Run WAHA Core with the following environment variables set:
WAHA_API_KEY=<some_key>
WHATSAPP_SWAGGER_USERNAME=admin
WHATSAPP_SWAGGER_PASSWORD=<some_password>
Open the dashboard in a browser
Complete Basic Auth login with WHATSAPP_SWAGGER_USERNAME / WHATSAPP_SWAGGER_PASSWORD
Open browser DevTools → Network tab
Inspect the request headers of any API call made by the dashboard (e.g. GET /api/sessions)
Expected Behavior
The dashboard should send the value of WAHA_API_KEY in the x-api-key header.
Actual Behavior
The x-api-key header contains the value of WHATSAPP_SWAGGER_USERNAME instead of WAHA_API_KEY:
x-api-key: admin
This causes all dashboard requests to return 401 Unauthorized when WAHA_API_KEY !== WHATSAPP_SWAGGER_USERNAME.
Workaround
Set WAHA_API_KEY to the same value as WHATSAPP_SWAGGER_USERNAME:
WAHA_API_KEY=admin
WHATSAPP_SWAGGER_USERNAME=admin
This is obviously not ideal from a security standpoint, as it forces the API key to be a predictable value.
Additional Notes
The API itself works correctly — requests made directly with curl using the proper X-Api-Key header are authenticated successfully. The issue is isolated to the dashboard frontend.