The WhatsApp API Gateway
Built for Modern Teams
Link your existing WhatsApp personal or business number via QR scan or 8-digit pairing code. Dispatch high-throughput transactional alerts via flat REST or drop-in Meta Cloud schema, automate replies with keyword chatbots, and receive HMAC-signed webhooks with 100% data ownership.
$0.00
Per-Msg Gateway Fee
100%
Self-Hosted Privacy
Dual API
REST + Meta Schema
HMAC-256
Signed Webhooks
-H "X-API-Key: wa_live_YOUR_KEY" \
-d '{
"to": "919876543210",
"message": "Order #84920 shipped! 🚀",
"humanize": true
}'
Decoupled Asynchronous Pipeline
Engineered for zero downtime. Your application never blocks waiting on WhatsApp socket handshakes.
Ingestion & Auth Gateway
Your application sends a POST /api/send. PHP 8.2 validates the API token, enforces rate limits, normalizes the recipient phone to international format, and validates media attachments.
200 Queued in <15ms
Persistent Queue Buffer
Messages enter the message_queue table with state pending. Database persistence ensures messages survive server restarts or temporary network glitches.
Baileys Dispatch Engine
The Node.js Baileys worker maintains a persistent multi-device WebSocket connection to WhatsApp. It simulates human typing presence (composing), applies anti-ban pacing, and dispatches to WhatsApp servers.
Inbound Webhooks & Automated Chatbot Processing
When a customer replies or a message delivery state changes, Baileys immediately fires your keyword chatbot rules and forwards an HMAC-SHA256 signed event payload to your webhook endpoint.
Everything for Professional Messaging
Battle-tested features built for developers, SaaS platforms, and enterprise support automation.
QR Code & 8-Digit Pairing
Link any personal or business WhatsApp number in seconds. Scan the in-dashboard QR code or use the 8-digit phone pairing code without pointing a physical camera.
Asynchronous Queuing & Throttle
Enqueue thousands of messages with sub-second response times. The background worker throttles traffic safely with configurable pacing (SEND_DELAY_MS) and typing indicators.
Automated Keyword Chatbots
Configure instant auto-replies for incoming queries. Build exact match keywords, substring contains rules, and welcome flows to assist users 24/7 without extra bot server overhead.
HMAC-SHA256 Signed Webhooks
Subscribe to HTTPS callbacks for inbound messages, delivery receipts, and read confirmations. Every webhook payload is signed with your shared secret to guarantee authenticity.
PDF, Documents & Rich Media
Attach invoices, images, catalogs, PDFs, and audio recordings seamlessly. Supports direct remote HTTP URLs, Base64 data strings, or standard multipart form uploads.
CSV Broadcasts & Campaigns
Manage contact books, import customer records from CSV or Google Contacts, and schedule personalized broadcast campaigns with custom tags ({name}).
Code Once, Dispatch Anywhere
Test real cURL, Node.js, Python, PHP, or drop-in Meta Cloud payloads. Authenticate with a single API token.
# Send a transactional text alert
curl -X POST "https://whatsapp-api-xepo.onrender.com/api/send.php" \
-H "X-API-Key: wa_live_YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"to": "919876543210",
"message": "Your verification OTP is *582910*. Valid for 10 minutes.",
"humanize": true
}'
POST /api/send.php
• Single Key / Bearer Auth
{
"ok": true,
"status": "queued",
"message_id": 1042,
"request_id": 582,
"recipient": "919876543210",
"type": "text",
"has_media": false,
// Meta Cloud API Compatibility
"messaging_product": "whatsapp",
"contacts": [
{
"input": "919876543210",
"wa_id": "919876543210"
}
],
"messages": [
{
"id": "wamid.b29e01f4c78a...",
"message_status": "accepted"
}
]
}
Secure Google Contacts Integration
Sync your existing customer contacts directly from your authorized Google Account. We use standard OAuth 2.0 PKCE to request strictly read-only access (contacts.readonly) solely for populating your address book.
How It Compares
Compare self-hosting our open-source gateway against official Meta Cloud and commercial SaaS brokers.
| Capability / Metric | WhatsGateway (Self-Hosted) | Meta WhatsApp Cloud API | Commercial SaaS Brokers |
|---|---|---|---|
| Gateway Per-Message Markup | $0.00 (Zero) | Per-conversation Meta charges | $0.005 – $0.05 extra per msg |
| Setup & Phone Linking | Instant QR / 8-digit Pairing Code | Requires Meta Business Verification | Complex onboarding & review |
| Database & Session Control | 100% on your private server/DB | Hosted in Meta cloud | Vendor cloud lock-in |
| API Payload Compatibility | Flat REST + Drop-in Meta Cloud schema | Meta Graph schema only | Proprietary vendor SDKs |
| Inbound Webhooks | HMAC-SHA256 Signed POST Callbacks | Hub signature validation | Varies / Rate-limited |
| Built-in Keyword Chatbots | Included • Instant auto-reply rules | Requires external bot server | Expensive add-on tier |
| Google Contacts Sync | Built-in Google OAuth2 PKCE | None | Requires third-party sync tool |
Direct Answers for Engineers
Clear technical explanations with no marketing fluff.
Do I need a verified Meta Business Manager account to use this?
How does this gateway protect against account bans?
- Configurable queue pacing delays (
SEND_DELAY_MS, defaulting to 2500ms between messages). - Automatic human typing presence updates (
sendPresenceUpdate('composing')). - We strongly advise sending transactional notifications and reminders only to users who have explicitly opted in.
Where are WhatsApp session keys and messages stored?
whatsapp-api-data/sessions/ directory using Baileys' multi-file auth state. Messages, delivery states, and contact records reside directly in your local MySQL / TiDB database. Nothing is transmitted to external servers or third-party brokers.
How does the Meta Cloud API drop-in compatibility work?
Authorization: Bearer token. The endpoint parses Meta schemas (including text bodies, templates, documents, and contacts) and returns compliant JSON response bodies.
What are the minimum hardware requirements?
Take Full Control of Your WhatsApp Messaging
Say goodbye to per-message markup, complex business approval gates, and vendor lock-in. Deploy your private instance in minutes.