Helpwise
BUSINESS · EMAIL
Shared-inbox conversations and the SMS and WhatsApp messages sent from them.
Connecting Helpwise in practice
Helpwise authenticates with a key and a secret sent as HTTP Basic base64(API_KEY:API_SECRET), so the credential is a pair rather than a bearer token, and the limit is a flat 100 requests per minute per API key. Plan-dependent usage limits sit on top of that rate limit and share the same 429, so a rejected request may be over volume rather than over rate.
Scopes that draw scrutiny
API_KEY and API_SECRET (Basic base64(API_KEY:API_SECRET))Both halves come from the Helpwise settings page and there is no scope system, so a single credential covers conversations, contacts and outbound SMS and WhatsApp sends.
Rate limits
- 100 requests per minute per API key.
- Plan-dependent usage limits apply on top; exceeding either returns HTTP 429 Too Many Requests.
- X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (UTC epoch seconds) on every response.
- HTTP 503 signals an unexpected spike in API traffic rather than a client fault; Helpwise says the server is usually operational within five minutes.
Worth knowing
- A 429 does not distinguish the per-minute rate limit from the plan usage limit, so waiting a minute fixes only one of the two causes and looks like a flaky API for the other.
- Requests sent over plain http:// are answered with a 301 to the HTTPS resource — which means the Basic credential has already left the client unencrypted, so the base URL has to be https from the first call.
- Sending a message is channel-specific: SMS, WhatsApp and a scheduled variant of each are separate endpoints rather than one call with a channel parameter.
- A missing, malformed or invalid key all return the same 401, so there is no way to tell a rotated key from a wrong one without checking the dashboard.
Checked against Helpwise API documentation (2026-09-29), Helpwise developers (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Helpwise behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.