Why WhatsApp Integration Deserves Proper Engineering
For many businesses in Indonesia, WhatsApp is not just another channel. It is where customers ask about stock, send payment receipts, chase deliveries, and complain. Once volume grows, a single phone held by an admin stops working. Messages get missed, history is scattered across devices, and customer data never reaches the CRM or order system.
That is when many businesses reach for third-party tools that "automate" WhatsApp through WhatsApp Web or modified apps. The outcome is usually the same: the number gets restricted, bulk messages are flagged as spam, and the integration stops without warning. We often meet businesses that only look for the official route after their main number is already in trouble. This guide covers that official route, the rules you must follow, and the technical patterns that keep an integration reliable.
WhatsApp Business App vs. WhatsApp Business Platform
Meta offers two products with similar names and very different purposes.
| Aspect | WhatsApp Business App | WhatsApp Business Platform (Cloud API) | | ----------------------- | --------------------------------- | -------------------------------------------------------- | | How it works | Phone app, operated by people | An API called from your own systems | | System integration | Very limited | Full: CRM, order system, chatbot, dashboards | | Starting a conversation | Any contact who saved your number | Only with an approved message template | | Multiple agents | Limited | Not tied to devices; handled in your application | | Cost | Free | Per delivered message, by category and recipient country |
Best for: the Business App suits small shops served by one or two people. Cloud API suits businesses that need automated notifications, multiple agents, or conversation data flowing into other systems.
Meta also supports coexistence: a number already used in the WhatsApp Business App can be connected to Cloud API through an official provider, so staff can keep replying from the app. The trade-off, per Meta's throughput docs, is a fixed limit of 20 messages per second for coexistence numbers, while regular Cloud API numbers start at 80.
Two Official Routes: Direct or Through a BSP
There are two legitimate ways to use Cloud API:
- Direct integration. You create an app in Meta for Developers, connect your business portfolio, and your system calls the Graph API itself. Full control and no extra platform fee, but your team owns webhooks, tokens, and monitoring.
- Through a Business Solution Provider (BSP). An official Meta partner provides a dashboard, a shared team inbox, and sometimes a ready-made chatbot. Setup is faster, but you pay a subscription and depend on the partner's features and API.
Best for: direct integration when WhatsApp must fit tightly into internal systems or custom flows; a BSP when the main need is a shared inbox for customer service. The trade-offs mirror our build vs. buy framework.
Whichever route you take, avoid any service that asks you to scan a WhatsApp Web QR code to get "API access". That is not an official route and it breaches WhatsApp's terms.
The Rules You Need to Know
1. Opt-in comes first
The WhatsApp Business Messaging Policy requires two things before you contact someone: they gave you their number, and they agreed to receive messages from your business. Meta's opt-in guide adds that the consent must clearly name your business and the kind of communication. Opt-out requests must be honoured.
Fix: store proof of opt-in (time, source, consent text), separate consent by message category (order updates vs. promotions), and make opting out easy. Collecting phone numbers also falls under Indonesia's Personal Data Protection Law (Law No. 27 of 2022), so review the consent wording with your legal advisor.
2. The 24-hour window and templates
Every customer message opens a 24-hour customer service window. Inside it, you can reply freely. Outside it, a business can only start a conversation with a Meta-approved message template. Templates fall into three categories: marketing, utility (order confirmations, shipping updates), and authentication (OTPs).
Fix: design templates early, because approval is its own process. Don't dress up promotions as utility templates; Meta can recategorise or reject them.
3. Bots are allowed, with a way out
WhatsApp's policy allows automation inside the 24-hour window as long as there is a clear escalation path, such as handing over to a human agent, a phone number, or email. This matches what we wrote in AI Chatbot vs. AI Agent: a bot that can't hand off to a person creates more complaints, not fewer.
4. Sending limits ramp up gradually
According to the messaging limits docs, a new business portfolio can only reach 250 unique users outside the service window in a rolling 24 hours. The limit rises to 2,000 after business verification, then scales automatically to 10,000, 100,000, and unlimited when message quality is good and capacity is being used. The limit is shared by every number in the portfolio.
Fix: verify your business in Meta Business Suite before launch, and don't plan a large broadcast in week one.
Cost: Charged per Delivered Message
Since 1 July 2025, Meta charges per message delivered (not merely sent), with rates based on message category and the recipient's country code. Indonesia has its own rate, and rate cards are available in rupiah. As of 1 October 2026, Meta's pricing page states that service messages are charged again after 1,000 free messages per number per month, and utility templates sent inside the service window are charged again too.
Fix: take current rates from the official rate card, not from blog posts or vendor decks, since Meta can update pricing at the start of each quarter. Store the pricing object from status webhooks so you can report cost per category every month.
Technical Patterns for a Reliable Integration
1. Verify the webhook and its signature
When you register a webhook, Meta sends a GET request with hub.verify_token and hub.challenge; your endpoint must match the token and echo the challenge. Every POST after that carries an X-Hub-Signature-256 header: an HMAC-SHA256 of the raw body using your app secret (webhook endpoint docs).
import { createHmac, timingSafeEqual } from "node:crypto";
export function isValidSignature(rawBody: string, header: string, appSecret: string) {
const expected = createHmac("sha256", appSecret).update(rawBody).digest("hex");
const received = header.replace("sha256=", "");
return (
received.length === expected.length &&
timingSafeEqual(Buffer.from(received), Buffer.from(expected))
);
}
Hash the raw body, not re-serialised JSON; a single whitespace difference changes the result.
2. Acknowledge fast, process later
If your endpoint doesn't return 200, Meta retries with decreasing frequency for up to 7 days (webhooks overview). An endpoint that waits on an AI model or a heavy query invites redeliveries.
Fix: check the signature, put the payload in a queue or table, return 200, and process it in a separate worker.
3. Idempotency for duplicates
Meta states that retries can produce duplicate notifications. Without protection, one customer message can create two tickets or two bot replies.
Fix: use the message ID (wamid) as a unique key and skip anything already processed. It is the same idempotency principle from 5 API Integration Mistakes.
4. Keep your own history
There is no API to fetch historical webhook data. If you don't store a payload when it arrives, it's gone.
Fix: store raw payloads with a defined retention period, then move what you need into conversation tables. Set retention according to business needs and your privacy policy.
5. Manage tokens and watch quality
Use a system user token rather than a personal one that expires, and keep it in a secret manager. Subscribe to phone number quality and template status webhooks so the team knows early when quality drops or a template is paused.
Go-Live Checklist
- Business verified in Meta Business Suite, display name approved.
- Opt-in and opt-out recorded in your database.
- Utility and authentication templates approved.
- Webhook verifies signatures, responds fast, and is idempotent.
- Bot has an escalation path to a human.
- Payment method added in Billing Hub.
- Dashboard tracks failed messages, number quality, and cost per category.
The AY Labs Approach
We treat WhatsApp as a production API integration, not a chat button. Every project starts by mapping the flow: which messages must be automated, which stay with people, and which data has to reach your systems. Then we build on the official Cloud API with webhook verification, idempotency, queues, and monitoring from day one, either directly with Meta or on top of the BSP you already use. If you're weighing which route fits, we're happy to work through it with your team.
