Unofficial WhatsApp API: How It Works and the Real Risks
You want software to send and receive WhatsApp messages on the number your customers already have saved. Meta's official route asks for a business portfolio, approved templates, per-message fees and, in most setups, a number that stops working in the normal app. So you look for another way and find dozens of services selling an unofficial WhatsApp API for a flat monthly price.
They are real, they work, and plenty of small businesses run on them. They also carry risks that most sales pages skip: your number can be banned, WhatsApp's terms do not authorize them, and the protocol underneath can change without warning.
This guide explains how an unofficial WhatsApp API works, why teams pick one anyway, what can go wrong, and how to lower the risk without pretending it disappears.
Key takeaways
- An unofficial WhatsApp API connects to your account as a linked device, the same mechanism WhatsApp Web uses, and wraps it in an HTTP API.
- It gives you things the official platform can't: groups you're already in, no templates, your current number and its recent history, flat pricing.
- WhatsApp's terms do not authorize unofficial clients or automated bulk messaging, and no provider can promise your number won't be banned.
- Risk drops when you message people who already know you, reply more than you initiate, and send at a human pace.
How an unofficial WhatsApp API works
It logs in to your WhatsApp account as one of its linked devices, then turns HTTP requests into WhatsApp messages.
Since WhatsApp moved to multi-device, one account runs on a primary phone plus companion devices such as WhatsApp Web and Desktop. You add a companion by scanning a QR code from the phone. Each companion holds its own encryption keys and talks to WhatsApp's servers directly, which is why WhatsApp Web keeps working when your phone is off.
An unofficial API is a server that becomes one of those companions. The flow looks like this:
- The provider (or your own server) starts a client session and shows a QR code.
- You scan it on your phone under Linked devices.
- The server stores the session keys and stays connected to WhatsApp.
- Your code calls the provider's endpoint ("send this text to this number") and the client sends it as your account.
- Incoming messages reach the client, are decrypted there, and are forwarded to you as webhooks.
There are two broad ways to build that client. Browser automation runs the real WhatsApp Web page in a headless browser and scripts it: easy to start, heavy to run, and fragile when the page changes. Protocol clients reimplement the multi-device protocol directly over a WebSocket: much lighter, but you are tracking a protocol WhatsApp has never published. Open-source projects of both kinds exist in JavaScript, Go and Python, and most hosted services wrap one of them and add a dashboard, webhooks and billing.
One consequence matters more than the rest. Messages are end-to-end encrypted to the linked device, and the linked device is the provider's server. Whoever runs that server can read every message on the number and send as you. Picking a provider is a decision about your customers' data, not only a feature comparison.
Why teams choose one anyway
Because it matches how small teams already use WhatsApp, and the official platform doesn't.
| Need | Official Cloud API | Unofficial (linked-device) API |
|---|---|---|
| Keep your current number in the phone app | Only via coexistence for Business app numbers, with limits | Yes, the phone keeps working |
| Groups you're already in | No (the Groups API only creates new invite-only groups of up to 8, for Official Business Accounts) | Yes |
| Message without templates | Only inside the 24-hour customer service window | Yes, at your own risk |
| Pricing | Per delivered message by category and country, plus any provider fees | Usually a flat monthly fee |
| Setup | Business portfolio, app, number registration, payment method | A QR scan |
| Buttons, Flows, green tick | Yes | No |
| Throughput | 80 messages per second per number by default | A few messages a minute, if run responsibly |
| Endorsed by Meta | Yes | No |
For a clinic answering patients or a broker working society groups, the right-hand column often fits better. For a bank sending login codes, only the left one does. If groups are the reason you're here, see how to send messages to WhatsApp groups by API; for the official side, see our explainer on the WhatsApp Cloud API.
The real risks
There are four: bans, terms, breakage and data exposure.
Bans. WhatsApp runs automated spam detection on every account, and its help center says accounts engaged in spam, automated or bulk messaging can be banned. Recipients blocking and reporting you is a well-known trigger. A banned number is the number on your invoices and signboards, and losing it costs far more than any API bill. Our guide on why WhatsApp bans numbers covers the patterns.
Terms. WhatsApp's Terms of Service list bulk messaging and auto-messaging among impermissible uses and bar accessing the service through unauthorized automated means. The WhatsApp Business app terms go further and bar businesses from using applications that interact with the Business app without WhatsApp's prior written consent. We read the documents line by line in is an unofficial WhatsApp API legal.
Breakage. The protocol is private and changes on WhatsApp's schedule. An update can break pairing, media or groups overnight, and a client that behaves oddly can itself look suspicious. Ask a provider how quickly they shipped fixes the last time it happened.
Data and session security. The stored session is effectively the account. If it leaks, someone else is you on WhatsApp. Ask where sessions and decrypted messages are stored, who on the provider's side can access them, and how long they are kept.
One quieter dependency: WhatsApp's help center says linked devices are logged out if the primary phone goes unused for more than 14 days.
How to reduce the risk
Behave like a busy, polite person on a number people recognise. None of these steps makes a number unbannable; they make it look like what it should be.
- Message people who expect you. Existing customers, people who wrote first, groups you run. Cold messages to lists are the pattern most likely to end in a ban.
- Reply more than you initiate. A healthy number is mostly two-way conversations.
- Pace sends. Seconds between messages, not hundreds in a minute.
- Write to the person. Use their name and the real detail (the order, the appointment). Identical blasts read as spam to people and to filters alike.
- Warm up new numbers before any volume. Our guide to warming up a WhatsApp number has a schedule.
- Honour "stop" instantly and remove the contact from future sends.
- Keep the phone active and on a current WhatsApp version.
- Watch for warnings. A temporary restriction, a wave of blocks or a sudden drop in replies means stop and review, not push harder.
Treat any provider that sells "ban-proof" sending as a red flag. Nobody outside WhatsApp controls enforcement.
Questions to ask a provider
- Where does the session run, and who can read the messages?
- Does the service pace and cap sends for you, or will it fire whatever you hand it?
- What happens when the number disconnects? Is there an event so someone can rescan?
- How long are messages stored, and can you delete them?
- Does it claim Meta endorsement or a ban guarantee? Both are false for any linked-device service.
Related reads: what people mean by a WhatsApp Web API, getting WhatsApp API access without Meta approval, and whether you can keep using WhatsApp on your phone after the API.
Where Tenashi fits
Tenashi is one of these linked-device services, and we say so up front: you link your existing WhatsApp or WhatsApp Business number by QR scan, it is not Meta's Business Platform, and it is not endorsed by Meta. What it adds is the part raw unofficial APIs usually leave to you. Every API send goes through ban protection: each number sends one message every 4 to 12 seconds, new chats via the API are capped at 50 per number per day, the same text going to 5 chats within 10 minutes is paused, and new numbers warm up from 20 messages on day one.
Messages sent by API land in a shared team inbox with DMs and groups and a CRM under every chat, so a person picks up any reply with the full history in front of them. The honest limit: pacing reduces risk, it doesn't remove it, and Tenashi is not built for OTPs or thousands of messages a minute. For that, use the official Cloud API.
Read the API docs · Get started
FAQ
What is an unofficial WhatsApp API?
It is software that connects to a normal WhatsApp or WhatsApp Business account as a linked device, the way WhatsApp Web does, and exposes an HTTP API for sending and receiving messages. It is not part of Meta's WhatsApp Business Platform, so there are no templates or per-message fees, but WhatsApp does not authorize it either.
Can an unofficial WhatsApp API get my number banned?
Yes. WhatsApp can restrict or ban any account it judges to be sending spam or automated bulk messages, whatever software sent them. Pacing, messaging people who know you and replying more than you initiate all lower the risk. No provider can guarantee a number will never be banned, and claims otherwise are a warning sign.
Is an unofficial WhatsApp API the same as WhatsApp Web?
They use the same mechanism. WhatsApp Web is WhatsApp's own linked-device client running in your browser. An unofficial API is a third-party linked-device client running on a server, controlled by code instead of a person clicking. To WhatsApp's servers both look like companion devices on your account.
Can I switch to the official Cloud API later?
Yes. You would register the number on Cloud API, which normally means deleting the WhatsApp account on it first, unless it's a Business app number onboarded through coexistence. Chat history in the unofficial tool stays wherever that tool stored it. Many teams run both: official API for alerts, linked number for conversations.
Do unofficial WhatsApp APIs support buttons and templates?
Generally no. Interactive buttons, list messages, Flows and templates belong to Meta's Business Platform. A linked-device API sends what a normal WhatsApp account can send: text, media, documents, replies and messages in groups. If your flow depends on tappable buttons or approved templates, you need the Cloud API.
An unofficial WhatsApp API is a trade: groups, your own number and flat pricing in exchange for risk that you have to manage. If you want the linked-number route with pacing and a team inbox built in, read the Tenashi API docs, and for the full map of options see our complete guide to the WhatsApp API.