WhatsApp Business API Integration: How It Works

WhatsApp Business API integration is the connection that lets your own software — your e-commerce site, CRM, ERP or admin panel — send messages over WhatsApp automatically and process incoming replies. The difference from the WhatsApp Business app is fundamental: the API has no interface and is not installed on a phone. It plugs straight into your systems, lets unlimited agents work from one number, and fires messages off your order, appointment or payment data. Setup has four parts: verifying your Meta Business account, registering the number, submitting message templates for approval, and wiring a webhook for inbound messages. Below we walk through the technical flow, the Cloud API vs. BSP decision, the 24-hour rule that breaks most integrations in production, and how the cost is actually calculated.

What is the WhatsApp Business API, and how does it differ from the app?

Meta ships three different WhatsApp products for businesses, and confusing them gets expensive. The WhatsApp Business app is a free phone app for small businesses: one device, messages typed by a human. The WhatsApp Business Platform (API) is not an interface at all but a service: your software sends the message, your server receives the reply. The third option is a ready-made panel built on top of the API by a solution provider (BSP) — a practical shortcut for companies without a development team.

• Who sends the message? In the app, an agent types it. Over the API, an event does — order status, appointment time, payment received.
• How many people can use it? The app is one phone plus limited linked devices; the API supports as many agents and automations as you need on a single number.
• Volume: Bulk sending from the app is impractical and puts your number at risk; API sending limits scale in tiers as your quality rating holds up.
• Data: The app keeps conversations on the phone; the API streams the entire history into your own database, next to your CRM records.
• Cost: The app is free; the API is billed per message by Meta, plus a provider margin if you use a BSP.

A simple rule: if a human still drives the conversation, the app is enough. If the message originates in software — “your parcel has shipped”, “your appointment is at 2pm tomorrow”, “we received your payment” — you need the API. This is the WhatsApp-facing side of the system-to-system conversation we described in what is API integration.

Cloud API or BSP? Getting the starting decision right

Using the API used to require a solution partner. Meta’s Cloud API removed that requirement: it is the official endpoint hosted on Meta’s own servers, called directly through the Graph API, with no separate infrastructure fee — you pay only for messages. BSPs layer an agent inbox, campaign interface, reporting and support on top of the same API.

• Cloud API directly: The cheapest and most flexible route if you have a development team. Messages leave your own system, your data stays with you, and no intermediary takes a cut.
• Through a BSP: Sensible when you have no technical team, or when you need a contact-centre style agent inbox. You pay a per-message margin and usually a platform subscription for it.
• Hybrid: Send automated notifications (orders, shipping, appointments) from your own software via Cloud API and route human support traffic through a ready-made panel — the most balanced setup for most mid-sized companies.

Answer one question before you choose: is WhatsApp a notification channel for you, or a support channel? Notifications need nothing more than the Cloud API; support needs an inbox. If you need both, design the hybrid model up front, because attaching one number to both a panel and your own software later is painful.

Setup: from account to first message

• 1. Meta Business account and business verification: Verify your company with registration documents and domain ownership. Until verification clears, sending limits stay low and your business name cannot be displayed.
• 2. Choosing and registering the number: The number you connect must not already be tied to a WhatsApp or WhatsApp Business account. To migrate a number in active use, delete the old account first; landlines work too, via voice verification.
• 3. Display name approval: The name shown on the customer’s screen is reviewed by Meta and has to match your brand. Generic names like “Campaign Centre” get rejected.
• 4. Submitting message templates: If you intend to message customers first, every wording has to be approved in advance. Approval usually takes minutes to hours.
• 5. Webhook connection: Define the HTTPS endpoint that receives inbound messages and delivery statuses. Skip this and you can send messages but will never see the replies.
• 6. Permanent access token and testing: Generate a non-expiring token through a system user. Never go live on a temporary token — the integration will stop silently after 24 hours.

The 24-hour rule is where integrations break in production: once a customer messages you, you can reply freely (text, images, files, buttons) for 24 hours. When that window closes, free-form messages are refused — only a pre-approved template can reopen the conversation. This is precisely the bug that never shows up in testing and surfaces on day two in production.

Message templates and the approval process

A template is a pre-approved message pattern, fixed except for its variables. Meta sorts templates into three categories and prices them accordingly: marketing (campaigns, discounts, cart reminders), utility (transactional notices like orders, shipping, appointments, invoices) and authentication (one-time codes). Sending the same text under the wrong category causes both rejections and needless cost — labelling a transactional notice as marketing is the most common mistake.

# Sending an approved template through the Cloud API (shipping notification)
curl -X POST "https://graph.facebook.com/v21.0/$PHONE_NUMBER_ID/messages" \
  -H "Authorization: Bearer $WHATSAPP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product": "whatsapp",
    "to": "447XXXXXXXXX",
    "type": "template",
    "template": {
      "name": "order_shipped",
      "language": { "code": "en" },
      "components": [{
        "type": "body",
        "parameters": [
          { "type": "text", "text": "Sarah" },
          { "type": "text", "text": "TR123456789" }
        ]
      }]
    }
  }'

The inbound side is a webhook: Meta first probes your endpoint with a verification request, then POSTs every message to it. The critical detail is to answer with a 200 immediately and queue the work; delay the response and Meta retries the same message, so your customer receives duplicate replies.

// Next.js route handler — webhook verification + inbound messages
export async function GET(req: Request) {
  const url = new URL(req.url);
  const isValid =
    url.searchParams.get('hub.mode') === 'subscribe' &&
    url.searchParams.get('hub.verify_token') === process.env.WA_VERIFY_TOKEN;

  return isValid
    ? new Response(url.searchParams.get('hub.challenge'))
    : new Response('forbidden', { status: 403 });
}

export async function POST(req: Request) {
  const body = await req.json();
  const message =
    body.entry?.[0]?.changes?.[0]?.value?.messages?.[0];

  // Queue first, process later: a slow 200 makes Meta resend the message
  if (message) await enqueueIncomingMessage(message);

  return new Response('ok', { status: 200 });
}

How the cost is calculated

Meta charges no setup or subscription fee for the API itself; billing is per message. In 2025 Meta moved from conversation-based to per-message pricing: customer service conversations — the ones the customer starts, running inside the 24-hour window — are free, while templates you initiate are priced by category and by the recipient’s country. Marketing templates are the most expensive line; authentication and utility templates cost less. Current unit prices are published in Meta’s country-based rate card and do change, so never write a fixed figure into a contract.

• Meta message fee: templates sent × category and country rate. Budget from here: 10,000 shipping notices and 10,000 campaign messages do not cost the same.
• BSP margin (if you use one): a per-message uplift and, usually, a monthly platform subscription.
• Development: a one-way notification integration is a few days of work; a two-way support flow with queueing, agent handover and reporting runs into weeks.
• The hidden line item: wrong categories. Send transactional notices as marketing templates and you pay noticeably more for identical volume.

The most effective way to hold cost down is to reserve messages for moments that genuinely matter. Order and appointment notices sit in the cheaper category and get opened; campaign messages should be segmented before they are sent. If you are mapping the other links in the same chain, our article on payment integration for websites applies the same logic to other services.

Where it pays off, by business type

• E-commerce: order confirmation, tracking number, delivery notice and abandoned-cart reminders. Delivery and open rates are markedly higher than SMS.
• Appointment-based services (clinics, salons, workshops): reminders with one-tap confirm or cancel — the single most practical automation for cutting no-shows. It pairs with an online appointment system.
• B2B and dealer networks: stock levels, order status and balance notifications pushed to dealers without making them log into a portal.
• Support and chatbots: answer frequent questions with an AI-assisted flow and hand the rest to an agent. We covered the architecture step by step in how to build an AI chatbot.

Five mistakes we see most often

• Messaging a list without consent: marketing messages to numbers that never opted in drag down your quality rating and get the number restricted. Recovery takes weeks.
• One template for everything: patterns with too many variables and no clear purpose get both rejected and ignored.
• Handling the webhook synchronously: doing heavy work inside the request triggers retries and duplicate replies.
• Going live on a temporary token: the integration stops silently the next day. Use a system-user token.
• Treating data protection as an afterthought: phone numbers, conversation content and send logs are personal data, so consent, notice and a retention period have to be defined. See our guide on building a data-protection compliant website.

Conclusion

WhatsApp Business API integration is a few days of technical work; what really decides the outcome is the design — which message is triggered by which event. If you have a development team, start directly with the Cloud API; if you do not, consider the hybrid model that keeps notifications in your own system and support traffic in a panel. Either way, get the 24-hour rule and the template categories right from day one. If you are considering adding a WhatsApp notification flow to your existing e-commerce, ERP or CRM setup, take a look at our custom software service or tell us about your processes and get a free quote.