Trying to skip the Messenger widget and hit the Guest API directly. Got a valid access token via OAuth. POSTing to the endpoint for sending an agentless outbound message returns 401 Unauthorized. The token works fine for GET requests on the same contact. Checked the expiration, still good. JSON payload matches the docs. Is there a specific scope I’m missing for writing messages without the widget?
The issue is almost certainly the scope. The Guest API endpoints are picky. You can’t just use conversation:write or webmessaging:write. You need the specific guest scope attached to that token.
Here’s what the token request needs to look like to get the right permissions:
{
"grant_type": "client_credentials",
"scope": "webmessaging:guest"
}
If you’re using the SDK, make sure you’re initializing the client with that exact scope string. Without webmessaging:guest, the platform rejects the POST even if the token itself is valid for reading.
Also double-check the contactId. If that ID came from a different environment or was generated via the widget, it might not match the ID expected by the direct API call in your current context. But 9 times out of 10, it’s just the missing scope.