curl -X POST https://tawked.com/v1/partner/applications/batch \
-H "Authorization: Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: sync-2026-09-27" \
-d '{
"applications": [
{
"external_id": "store_88",
"name_ar": "متجر الورد",
"name_en": "Flower Shop",
"website": "https://flowers.example"
},
{
"external_id": "store_89",
"name_ar": "مخبز السنابل",
"name_en": "Sanabel Bakery",
"website": "https://sanabel.example"
}
]
}'const res = await fetch("https://tawked.com/v1/partner/applications/batch", {
method: "POST",
headers: {
Authorization: "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx",
"Content-Type": "application/json",
"Idempotency-Key": "sync-2026-09-27",
},
body: JSON.stringify({
"applications": [
{
"external_id": "store_88",
"name_ar": "متجر الورد",
"name_en": "Flower Shop",
"website": "https://flowers.example"
},
{
"external_id": "store_89",
"name_ar": "مخبز السنابل",
"name_en": "Sanabel Bakery",
"website": "https://sanabel.example"
}
]
}),
});
const data = await res.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tawked.com/v1/partner/applications/batch",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'applications' => '<array>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
res = requests.post(
"https://tawked.com/v1/partner/applications/batch",
headers={"Authorization": "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx", "Idempotency-Key": "sync-2026-09-27"},
json={
"applications": [
{
"external_id": "store_88",
"name_ar": "متجر الورد",
"name_en": "Flower Shop",
"website": "https://flowers.example"
},
{
"external_id": "store_89",
"name_ar": "مخبز السنابل",
"name_en": "Sanabel Bakery",
"website": "https://sanabel.example"
}
]
},
)
data = res.json(){
"created": 1,
"existing": 1,
"refused": 0,
"results": [
{
"index": 0,
"external_id": "store_88",
"outcome": "existing",
"application": {
"service_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"external_id": "store_88",
"status": "active",
"screening": {
"result": "clean",
"rules": []
},
"verify": {
"code_length": 6,
"ttl_seconds": 300,
"max_attempts": 3,
"max_per_hour": 5,
"autofill_domain": "flowers.example",
"autofill_domain_enabled": true,
"android_app_hash": null,
"daily_spend_cap_halalas": null,
"max_per_ip_per_hour": 20,
"max_new_destinations_per_hour": 300
},
"paused": false
}
},
{
"index": 1,
"external_id": "store_89",
"outcome": "created",
"application": {
"service_id": "9d1c2b3a-4e5f-4a6b-8c7d-0e1f2a3b4c5d",
"application_id": "9d1c2b3a-4e5f-4a6b-8c7d-0e1f2a3b4c5d",
"external_id": "store_89",
"status": "review",
"screening": {
"result": "clean",
"rules": []
},
"verify": {
"code_length": 6,
"ttl_seconds": 300,
"max_attempts": 3,
"max_per_hour": 5,
"autofill_domain": "flowers.example",
"autofill_domain_enabled": true,
"android_app_hash": null,
"daily_spend_cap_halalas": null,
"max_per_ip_per_hour": 20,
"max_new_destinations_per_hour": 300
},
"paused": false
}
}
]
}Provision in bulk
Up to 100 provisioning bodies in one call, for a migration or a sync. Items run in order, one at a time, each exactly like a single provision (screened, queued or activated, its own events); a refused item never stops the rest. Always 200 with the counts and one result per item in the same order: created, existing (the id was already yours; nothing applied from the item) or refused (fields names the refused ones, application is null). The same external_id twice in a batch is created then existing.
curl -X POST https://tawked.com/v1/partner/applications/batch \
-H "Authorization: Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: sync-2026-09-27" \
-d '{
"applications": [
{
"external_id": "store_88",
"name_ar": "متجر الورد",
"name_en": "Flower Shop",
"website": "https://flowers.example"
},
{
"external_id": "store_89",
"name_ar": "مخبز السنابل",
"name_en": "Sanabel Bakery",
"website": "https://sanabel.example"
}
]
}'const res = await fetch("https://tawked.com/v1/partner/applications/batch", {
method: "POST",
headers: {
Authorization: "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx",
"Content-Type": "application/json",
"Idempotency-Key": "sync-2026-09-27",
},
body: JSON.stringify({
"applications": [
{
"external_id": "store_88",
"name_ar": "متجر الورد",
"name_en": "Flower Shop",
"website": "https://flowers.example"
},
{
"external_id": "store_89",
"name_ar": "مخبز السنابل",
"name_en": "Sanabel Bakery",
"website": "https://sanabel.example"
}
]
}),
});
const data = await res.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tawked.com/v1/partner/applications/batch",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'applications' => '<array>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
res = requests.post(
"https://tawked.com/v1/partner/applications/batch",
headers={"Authorization": "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx", "Idempotency-Key": "sync-2026-09-27"},
json={
"applications": [
{
"external_id": "store_88",
"name_ar": "متجر الورد",
"name_en": "Flower Shop",
"website": "https://flowers.example"
},
{
"external_id": "store_89",
"name_ar": "مخبز السنابل",
"name_en": "Sanabel Bakery",
"website": "https://sanabel.example"
}
]
},
)
data = res.json(){
"created": 1,
"existing": 1,
"refused": 0,
"results": [
{
"index": 0,
"external_id": "store_88",
"outcome": "existing",
"application": {
"service_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"external_id": "store_88",
"status": "active",
"screening": {
"result": "clean",
"rules": []
},
"verify": {
"code_length": 6,
"ttl_seconds": 300,
"max_attempts": 3,
"max_per_hour": 5,
"autofill_domain": "flowers.example",
"autofill_domain_enabled": true,
"android_app_hash": null,
"daily_spend_cap_halalas": null,
"max_per_ip_per_hour": 20,
"max_new_destinations_per_hour": 300
},
"paused": false
}
},
{
"index": 1,
"external_id": "store_89",
"outcome": "created",
"application": {
"service_id": "9d1c2b3a-4e5f-4a6b-8c7d-0e1f2a3b4c5d",
"application_id": "9d1c2b3a-4e5f-4a6b-8c7d-0e1f2a3b4c5d",
"external_id": "store_89",
"status": "review",
"screening": {
"result": "clean",
"rules": []
},
"verify": {
"code_length": 6,
"ttl_seconds": 300,
"max_attempts": 3,
"max_per_hour": 5,
"autofill_domain": "flowers.example",
"autofill_domain_enabled": true,
"android_app_hash": null,
"daily_spend_cap_halalas": null,
"max_per_ip_per_hour": 20,
"max_new_destinations_per_hour": 300
},
"paused": false
}
}
]
}Authorizations
Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), email:manage (includes email:send), webhooks:manage, email:inbound, notifications:templates (includes notifications:read), chat:menus, chat:attendant. No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. Nor chat:menus: the five conversation menu operations answer such a key 403 insufficient_scope, and a connected app's key holds it once the client approved it. Nor chat:attendant: the five auto-attendant operations answer such a key 403 insufficient_scope too, and a connected app's key holds it once the client approved it. email:manage and webhooks:manage are held only by a key someone chose them for: a full-access key, old or new, never holds them. email:inbound, which reads, deletes and forwards received e-mail, is opt-in on every key, full access included: a key holds it only when it was turned on when the key was created. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.
Headers
A 1 to 128 printable-ASCII key you generate, scoped to your API key. Replaying it with the same request answers the original 2xx unchanged, with the response header Idempotent-Replayed: true, and runs nothing again; the same key with another request answers 409 idempotency_key_reused, and a request still in flight 409 idempotency_in_progress. A refused request is never stored, so a corrected retry under the same key runs. Keys expire after 24 hours.
Body
A list of 1 to 100 objects, each the body of a single provision (external_id, name_ar, name_en, website, and the optional industry, merchant, metadata, verify). Anything else answers 400 invalid_request with fields: ["applications"]; an item that is not an object is refused with fields: ["item"].