Connections & Security
Each Zapier connection represents one Bahasha user authorizing access to one organization. A connection can use all WhatsApp numbers owned by that organization, subject to its granted permissions.
Permissions
| Scope | Access |
|---|---|
account:read | Read organization identity for the connection label |
whatsapp:read | List connected numbers and approved templates |
whatsapp:send | Send template, free-form, and media messages |
whatsapp:events | Create instant message and status subscriptions |
contacts:read | Find and list contacts |
contacts:write | Create and update contacts |
An organization owner or a user with Integrations: Manage must approve and revoke connections.
Token and webhook security
- Connections use OAuth 2.0 Authorization Code flow with PKCE.
- Access and refresh tokens are opaque and stored hashed by Bahasha.
- Access tokens expire automatically and refresh tokens rotate.
- Revocation takes effect immediately.
- Zapier hook URLs are encrypted at rest and restricted to approved Zapier hook domains.
- System-managed OAuth credentials are hidden from the normal API Keys screen.
View authorized connections
Open Bahasha → Integrations → Zapier to see:
- Who authorized each connection.
- Granted permissions.
- Active Zap subscriptions.
- Authorization date and last use.
- Connection health and recent delivery activity.
Reconnect
If Zapier reports an expired or invalid connection, open the Bahasha account in Zapier and select Reconnect. Complete the Bahasha consent flow again.
Revoke
In Bahasha → Integrations → Zapier, find the authorized connection and select Revoke. Revocation:
- Invalidates its access and refresh tokens immediately.
- Removes subscriptions created by that connection.
- Causes existing Zaps using it to require reconnection.
Revoking one connection does not revoke other people who separately authorized the same organization.