You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/how-to/security/index.html
+9-9Lines changed: 9 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -67,13 +67,13 @@
67
67
Swagger panel with <code>admin / admin</code> credentials. This does not affect API access.</li></ul><divclass="callout callout-tip d-flex flex-row mt-4 mb-4 pt-4 pe-4 pb-2 ps-3"><svgwidth="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="outline/info-circle svg-inline callout-icon me-2 mb-3" id="svg-info-circle" role="img"><pathstroke="none" d="M0 0h24v24H0z" fill="none"/><pathd="M3 12a9 9 0 1018 0A9 9 0 003 12"/><pathd="M12 9h.01"/><pathd="M11 12h1v4h1"/></svg><divclass=callout-content><divclass=callout-body><p>You can also set <ahref=/docs/how-to/swagger/#white-label><strong>Swagger White Label</strong></a>
68
68
options instead of hiding the Swagger panel.</p></div></div></div><h2id=dashboard-security>Dashboard Security<ahref=#dashboard-securityclass=anchoraria-hidden=true>#</a></h2><p>Read more about <ahref=/docs/how-to/dashboard/><strong>📊 Dashboard</strong></a></p><p>When running WAHA you can set the following environment variables to configure the dashboard:</p><ul><li><code>WAHA_DASHBOARD_ENABLED=true</code> - enable or disable the dashboard, by default <code>true</code>. Set to <code>false</code> to disable the dashboard.</li><li><code>WAHA_DASHBOARD_USERNAME=waha</code> - username used to log in, by default <code>admin</code> or <code>waha</code></li><li><code>WAHA_DASHBOARD_PASSWORD=waha</code> - password used to log in, generated random.</li></ul><h2id=webhook-security>Webhook security<ahref=#webhook-securityclass=anchoraria-hidden=true>#</a></h2><p>To make sure that you get a webhook from your WAHA instance - you can use <strong>HMAC authentication</strong>.</p><p>Read more about
69
69
<ahref=/docs/how-to/events/#hmac-authentication><strong>🔄 Events</strong></a>.</p><h2id=https>HTTPS<ahref=#httpsclass=anchoraria-hidden=true>#</a></h2><p>After you set up the security options - you should set up HTTPS to protect the data in transit and prevent <ahref=https://en.wikipedia.org/wiki/Man-in-the-middle_attack>Man-in-the-middle attacks</a>.</p><p>That’s fine to run it on the <strong>local network</strong> without HTTPS, but for <strong>the production</strong> environment, HTTPS is a must-have.</p><div></div><divclass="callout callout-tip d-flex flex-row mt-4 mb-4 pt-4 pe-4 pb-2 ps-3"><svgwidth="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="outline/shield-check svg-inline callout-icon me-2 mb-3" id="svg-shield-check" role="img"><pathstroke="none" d="M0 0h24v24H0z" fill="none"/><pathd="M11.46 20.846A12 12 0 013.5 6 12 12 0 0012 3a12 12 0 008.5 3 12 12 0 01-.09 7.06"/><pathd="M15 19l2 2 4-4"/></svg><divclass=callout-content><divclass=callout-title><p>Use Nginx to handle HTTPS</p></div><divclass=callout-body><p>We <strong>recommend</strong> handling HTTPS termination with <strong>a reverse proxy</strong> like Nginx.</p><p>Follow
70
-
<ahref=/docs/how-to/install/#nginx><strong>🔧 Install & Update - Nginx</strong></a> to set up <strong>Nginx with Let’s Encrypt</strong>.</p></div></div></div><p>WAHA supports HTTPS out of the box if you don’t want to use a reverse proxy like Nginx (<strong>using Nginx is recommended</strong>)</p><p>You can set up the following environment variables to enable HTTPS:</p><ul><li><code>WAHA_HTTPS_ENABLED=true</code>: Set this variable to <code>true</code> to enable HTTPS. By default, it’s <code>false</code>.</li><li><code>WAHA_HTTPS_PATH_KEY=/path/to/key.pem</code>: The path to the key file for HTTPS. By default <code>./.secrets/privkey.pem</code></li><li><code>WAHA_HTTPS_PATH_CERT=/path/to/cert.pem</code>: The path to the certificate file for HTTPS. By default <code>./.secrets/cert.pem</code></li><li><code>WAHA_HTTPS_PATH_CA=/path/to/ca.pem</code>: The path to the CA file for HTTPS. By default <code>./.secrets/chain.pem</code></li></ul><h2id=faq>FAQ<ahref=#faqclass=anchoraria-hidden=true>#</a></h2><h3id=how-to-disable-security>How To Disable Security?<ahref=#how-to-disable-securityclass=anchoraria-hidden=true>#</a></h3><p>By default, WAHA checks those variables and if it’s not set - generates a random one (check your console/logs output):</p><ul><li><code>WAHA_API_KEY</code></li><li><code>WAHA_DASHBOARD_PASSWORD</code></li><li><code>WHATSAPP_SWAGGER_PASSWORD</code></li></ul><p>Even if you set this to "" (empty string) or “admin/waha/123” - WAHA generates a new value.</p><p>If you <strong>100% know what you are doing</strong> - you can disable this explicilty and set to <code>.env</code> file:</p><divclass=expressive-code><figureclass="frame not-content"><figcaptionclass=header><spanclass=title></span></figcaption><pretabindex=0><codeclass=language-dotenvdata-lang=dotenv># Api Key - Off
<ahref=/docs/how-to/install/#nginx><strong>🔧 Install & Update - Nginx</strong></a> to set up <strong>Nginx with Let’s Encrypt</strong>.</p></div></div></div><p>WAHA supports HTTPS out of the box if you don’t want to use a reverse proxy like Nginx (<strong>using Nginx is recommended</strong>)</p><p>You can set up the following environment variables to enable HTTPS:</p><ul><li><code>WAHA_HTTPS_ENABLED=true</code>: Set this variable to <code>true</code> to enable HTTPS. By default, it’s <code>false</code>.</li><li><code>WAHA_HTTPS_PATH_KEY=/path/to/key.pem</code>: The path to the key file for HTTPS. By default <code>./.secrets/privkey.pem</code></li><li><code>WAHA_HTTPS_PATH_CERT=/path/to/cert.pem</code>: The path to the certificate file for HTTPS. By default <code>./.secrets/cert.pem</code></li><li><code>WAHA_HTTPS_PATH_CA=/path/to/ca.pem</code>: The path to the CA file for HTTPS. By default <code>./.secrets/chain.pem</code></li></ul><h2id=faq>FAQ<ahref=#faqclass=anchoraria-hidden=true>#</a></h2><h3id=how-to-disable-security>How To Disable Security?<ahref=#how-to-disable-securityclass=anchoraria-hidden=true>#</a></h3><p>By default, WAHA checks those variables and if it’s not set - generates a random one (check your console/logs output):</p><ul><li><code>WAHA_API_KEY</code></li><li><code>WAHA_DASHBOARD_PASSWORD</code></li><li><code>WHATSAPP_SWAGGER_PASSWORD</code></li></ul><p>Even if you set this to "" (empty string) or “admin/waha/123” - WAHA generates a new value.</p><p>If you <strong>100% know what you are doing</strong> - you can disable this explicilty and set to <code>.env</code> file:</p><divclass=expressive-code><figureclass="frame is-terminal not-content"><figcaptionclass=header><spanclass=title></span></figcaption><divclass=highlight><pretabindex=0class=chroma><codeclass=language-bashdata-lang=bash><spanclass=line><spanclass=cl><spanclass=c1># Api Key - Off</span>
0 commit comments