Embed

Mint an embed token

Call from your server with a workspace API key. Returns a single-use embedUrl (valid 60 seconds, only from origin) that opens one WhatsApp conversation in an iframe as the given Spur user, for an 8-hour session. Creates the contact from contact.number if needed. channelId (or conversationId) is required unless the workspace has exactly one WhatsApp number. Rate limit: 600 tokens per minute per workspace.

post/embed/tokens

Request

Base URL
https://api.spurnow.com
Auth
HTTP bearer

Request body

conversationIdnumber

Open this conversation directly. It already identifies the WhatsApp number.

channelIdnumber

Which of your WhatsApp numbers to open, with contact. Required when the workspace has more than one WhatsApp number.

originstring required

Origin of the page that will show the frame. Must be on the allowed list.

codeChallengestring required

BASE64URL(SHA-256(codeVerifier)), 43 characters (PKCE, S256). The CRM page makes a random codeVerifier for each frame and sends only this hash to your server; when the frame posts spur:ready, the page answers with spur:verify and the verifier. Without it the link opens nothing, so a leaked embedUrl is useless.

ttlnumber

Token lifetime in seconds. Default and maximum 60. This is the token's life, not the session's.

Example request

{
  "user": {
    "id": 318,
    "email": "crm@acme.com"
  },
  "contact": {
    "number": "+919876543210",
    "id": 9812,
    "firstName": "Rahul",
    "lastName": "Sharma",
    "email": "rahul@example.com"
  },
  "conversationId": 49205067,
  "channelId": 1042,
  "origin": "https://crm.acme.com",
  "codeChallenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "ttl": 60
}

Response

tokenstring required

Single-use token. Already part of embedUrl.

embedUrlstring required

Set this as the iframe src. Works once, within 60 seconds, from origin, and only with the code verifier.

expiresAtstring date-time required

userIdnumber required

contactIdnumber required

Store this on your CRM record and mint with it next time.

conversationIdnumber required

The conversation the frame opens (inboxId).

channelIdnumber required

The WhatsApp number the conversation is on.

sessionTtlnumber required

Session length in seconds once the frame loads.

Example response

{
  "token": "emb_…",
  "embedUrl": "https://embed.spurnow.com/auth?token=emb_…",
  "expiresAt": "2026-10-20T10:31:04Z",
  "userId": 318,
  "contactId": 9812,
  "conversationId": 49205067,
  "channelId": 1042,
  "sessionTtl": 28800
}

Changes

No recorded changes to this operation across all 1 revision of this API.