Skip to Content
Beta: Hubz API v1 is being rolled out to production. Endpoints and limits may change; every change is listed in the Changelog.

Hubz API v1 (beta) · Hubz v0.7.0 · 2026-11-06

Authentication and key scopes

Integration keys

Only the business owner can create keys, under Integrations in Hubz. Send the key with every request:

Authorization: Bearer hbz_live_xxx

Creating and revoking keys, and every API call that changes data (sending messages, linking customers, registering webhooks), are logged. If a key may have leaked, revoke it under Integrations and create a new one.

Acting as a staff member

By default a key acts as the person who owns it. Add the X-Hubz-User header with the email of a staff member who works at the company to act as that person:

curl https://api.hubz.vn/v1/me \
  -H "Authorization: Bearer hbz_live_xxx" \
  -H "X-Hubz-User: lan@example.com"

Everything that can be seen or answered follows that person's permissions in Hubz, further narrowed to the Zalo accounts the key may use.

Key scopes

ScopeAllows
readReading contacts, conversations, messages and Zalo accounts.
sendSending messages. Without it, the embedded chat is read only.
linkLinking a contact to a record in your software, and unlinking it.
eventsReceiving events: webhooks and GET /v1/events.

Keeping keys safe

  • Call the API from your server only; never put a key in a browser or a mobile app.
  • Never commit keys to public code or paste them in chats.
  • Verify the X-Hubz-Signature of every webhook before processing it.

Hubz is not affiliated with Zalo or VNG; Hubz does not use Zalo’s official API. Hubz is not affiliated with Odoo S.A.; Odoo is a trademark of Odoo S.A.