Your login
Sign-in is by email and password or Sign in with Google. A password must be at least 6 characters when you create it or reset it.Changing your password
Settings → Login & security → Password. You are asked for your current password as well as the new one, and the new password must be at least 8 characters. If the current password is wrong, nothing is changed. If you have forgotten it, use Forgot password? on the sign-in screen instead — see Signing in.Signing out everywhere
Settings → Login & security → Active sessions → Sign out of all devices. This revokes every session for your login, on every device, including the one you are using. Everyone who is signed in as you has to sign in again. Use it if a device is lost or a password has been shared.What other members can see
A workspace is shared. Every member of a workspace can read its contacts, conversations, messages, deals and templates — that is the point of a shared inbox. What changes between members is what they may write, which is decided by their role:
Workspaces are isolated from each other. A member of one workspace cannot read
another’s data, even when the same login belongs to both — what you see is
always the workspace you have open. Full detail: Members and
roles.
Credentials Watx stores for you
Connecting a channel or an integration means Watx holds a credential on your behalf. All of them are encrypted at rest (AES-256-GCM), decrypted only at the moment they are used, and never returned in an API response or written to a log:- WhatsApp and Instagram access tokens from Meta
- Shopify and WooCommerce store credentials
- Your Razorpay key secret, if you collect payments from your own customers
- The shared secret for the Google Apps Script bridge
- An AI provider API key, if you bring your own
- Headers on a custom AI action, which is why the interface shows header names only
- Signing secrets for outbound webhooks
Two kinds of credential are shown once and never again, because Watx
stores only a hash of them: API keys and invite links. There is no way
to reveal either a second time — revoke it and create a new one.
API keys
An API key authenticates the public REST API on behalf of the whole workspace, so it is as powerful as the scopes granted to it. Grant only what an integration needs, name it after the integration, and revoke it the moment it is no longer in use. See API keys.The Google Apps Script bridge
The Google integration works the other way round from most: a small script runs in your own Google account and Watx calls it. Watx holds the deployment URL and a secret it minted for you. Because the deployment belongs to you, Watx cannot revoke it — you can, by deleting the deployment in Apps Script. See Google.Data-deletion requests
From a customer who messaged you
Conversations and contact records live in the workspace of the business the customer messaged. They belong to that business, so that business controls them: a member with the Agent role or above can delete a contact from Contacts. If a customer writes to Watx instead, we point them at the business and help where we can.app.watx.in that confirms what was deleted.
It needs no login, and it quotes the confirmation code Meta issued.
When such a request arrives, the Instagram connection it relates to is deleted
along with the access token stored for it — Watx can no longer read or send
messages, or read comments, on that Instagram account.