WhatsApp API: The Complete Guide for Teams and Developers

Q: Is using an unofficial WhatsApp API allowed?

WhatsApp's [terms of service](https://www.whatsapp.com/legal/terms-of-service) prohibit using the service through automated means in unauthorized ways, and forbid bulk and auto-messaging. Meta does not endorse unofficial APIs, and WhatsApp can ban numbers it sees spamming. Careful pacing, messaging only people who know you and skipping cold bulk outreach reduce that risk without removing it.

Tenashi Team·October 29, 2026·24 min read

You want WhatsApp wired into the business. Order updates that send themselves, a website form that lands in a chat, a support team answering from one screen, maybe your own product messaging its users. Search for "WhatsApp API" and you get a Meta developer portal, a wall of vendors and GitHub projects that promise everything for free. They are not describing the same thing.

The WhatsApp API is really two families. One is Meta's official WhatsApp Business Platform, built around the Cloud API, with templates, per-message pricing and approval steps. The other is a set of unofficial and linked-number APIs that drive a normal WhatsApp account the way WhatsApp Web does. Each is right for some jobs and wrong for others.

This guide covers both, with the numbers that matter as of October 2026: how the official API works, what it costs after the October 1 pricing change, the limits you will hit, how to get access, and when a linked-number API is the better fit.

Key takeaways

"WhatsApp API" means either Meta's official WhatsApp Business Platform or a linked-number API that runs on a regular WhatsApp account. They differ on cost, rules and risk.
Meta's Cloud API is hosted by Meta, free to access and billed per delivered message by category and country. The old On-Premises API stopped delivering messages on October 23, 2025.
Outside a 24-hour customer service window, the official API only sends approved templates. Inside it, you can send free-form messages.
Since October 1, 2026, service replies are free only for the first 1,000 per number per month, and utility templates sent inside the window are charged again.
Linked-number APIs use your existing number and your existing groups with no templates or per-message fees, but they are paced, not endorsed by Meta and wrong for OTPs or high volume.

What "WhatsApp API" actually means

There are two kinds of WhatsApp API, and most confusing claims online come from mixing them up: a Meta product with documented rules, and software that operates an ordinary WhatsApp account.

	Official WhatsApp Business Platform	Linked-number APIs
Who runs it	Meta hosts the Cloud API	A vendor or open-source library using a WhatsApp account as a linked device
Your number	Registered to the platform, so it stops working in the normal app (coexistence is the exception for Business app numbers)	Your existing WhatsApp or WhatsApp Business number, still working on the phone
Starting a chat	Approved template only	Any message, paced
Groups	Groups API for Official Business Accounts: new, invite-only groups of up to 8 people	The groups your number is already in
Cost	Per delivered message, by category and country, plus any provider fees	Usually a flat subscription
Meta's position	Supported and policy-bound	Not endorsed; WhatsApp can ban numbers
Best for	OTPs, transactional alerts at scale, campaigns, verified identity	Team conversations, groups, replies, follow-ups with people who know you

The official product used to be marketed as the "WhatsApp Business API", and most vendors still use that phrase. Today it is a set of pieces: the Cloud API for messaging, groups and calling, the Marketing Messages API for promotional sends, the Business Management API for templates and numbers, webhooks for everything inbound, and Meta Business Agent for AI customer service. Our map of the WhatsApp Business Platform walks through each one.

Linked-number APIs work differently. WhatsApp lets an account link companion devices such as WhatsApp Web. A linked-number API connects as one of those devices and sends and receives as that account. That is why they can see your groups and history, and also why Meta's rules and ban systems apply to them in a different way. If you are new to all of this, start with our plain-English explainer on what the WhatsApp API is.

How the official Cloud API works

The Cloud API is a set of HTTPS endpoints on Meta's Graph API. Meta hosts the servers, runs the encryption and scales the service, so your job is to make API calls and receive webhooks. Meta opened it to businesses of all sizes in May 2022, and it became the only option when the self-hosted On-Premises API was retired. Our post on the On-Premises API sunset covers that history.

You work with a handful of objects:

Business portfolio: the container in Meta Business Suite that owns everything and carries your business verification.
WhatsApp account: holds one business phone number and its display name. Accounts can be linked into a hierarchy.
Messaging account: holds templates, billing and webhook subscriptions. It keeps the ID your old WhatsApp Business Account (WABA) had. Meta split the WABA into these two account types from September 23, 2026, explained in our guide to the WhatsApp Business Account (WABA).
Phone number ID: the ID in every send URL. It is not the phone number itself.
System user access token: the long-lived credential your server uses.

Sending is one POST. This template send reaches someone who has not messaged you in the last 24 hours:

curl https://graph.facebook.com/v23.0/PHONE_NUMBER_ID/messages \
  -H "Authorization: Bearer $WHATSAPP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product": "whatsapp",
    "to": "+919811122233",
    "type": "template",
    "template": {
      "name": "order_shipped",
      "language": { "code": "en" },
      "components": [{
        "type": "body",
        "parameters": [
          { "type": "text", "text": "Priya" },
          { "type": "text", "text": "4821" }
        ]
      }]
    }
  }'

The example uses v23.0; use the current Graph API version listed in Meta's changelog. A successful response returns a message ID beginning wamid., but it only means Meta accepted the request. Delivery arrives later as a status webhook: sent, delivered, read or failed.

Receiving runs the other way. You register a webhook URL, Meta verifies it with a hub.challenge handshake, then POSTs JSON for every inbound message and status change. Each payload is signed in the X-Hub-Signature-256 header with an HMAC-SHA256 of the raw body using your app secret, and you should reject anything that fails the check. The full setup is in our guide to WhatsApp API webhooks.

Templates and the 24-hour window

The single rule that shapes every official integration: you can only send free-form messages while a customer service window is open. Per Meta's documentation, a 24-hour window opens when a user messages or calls you, and resets each time they do it again. Inside it, you can send text, media, reply buttons, lists, location requests and Flows. Outside it, you can only send a pre-approved template.

Templates come in three categories:

Marketing: promotions, offers, re-engagement, anything aimed at selling.
Utility: updates about a transaction or account the user started, such as order, delivery or appointment updates.
Authentication: one-time passwords and login codes.

Meta reviews each template, assigns or confirms its category and can recategorize it later, which changes what you pay. Templates also carry quality ratings. One that hits the lowest rating is paused for 3 hours, then 6 hours, and disabled on the third time, per Meta's pausing rules.

Before any of that, you need opt-in. Meta's policy requires that people give you their number and agree to hear from your business, by name, before you message them. Our deep dive on the WhatsApp 24-hour window shows how to build around these rules, and the complete guide to message templates covers the approval side.

What the official API costs in 2026

Access to the Cloud API is free. Messages are not. Since July 1, 2025, Meta charges per delivered message, and the price depends on two things: the message category and the recipient's country calling code, which Meta calls the market. As of October 2026, Meta's pricing page lists 47 markets: 39 named countries and 8 regions.

There are five categories:

Marketing templates, the most expensive category and the only one with no volume discount.
Utility templates, with volume tiers.
Authentication templates, with volume tiers and, in some markets, a higher authentication-international rate for businesses based elsewhere.
Service messages, which are free-form replies inside the window.
Meta Business Agent messages, priced at $2.00 per million tokens. Meta says a typical message uses 20,000 to 25,000 tokens, roughly 4 to 5 cents.

What is free:

Every message a user sends you.
Messages inside a free entry point window. When someone messages you from a Click-to-WhatsApp ad and you reply within 24 hours, Meta opens a window that can last up to 7 days, during which marketing, utility, authentication and service messages are free. Meta Business Agent messages are still charged.
The first 1,000 service messages per business number per month. They do not roll over.

The October 1, 2026 change is the one most teams missed. Service messages were free from November 2024 to September 2026. Now each number gets 1,000 free per month and pays per message after that. Utility templates sent inside an open window, free since July 2025, are charged again. Messaging accounts without a payment method get service messages delivered inside the free tier and dropped after it. Eligible government bodies and non-profits keep free service messages through December 31, 2027. Our explainer on service message charges has the detail.

To estimate a bill, work by line item. A clinic in one market that sends 3,000 appointment reminders and 2,500 replies in a month pays 3,000 times that market's utility rate, plus 1,500 times the service rate (the first 1,000 replies are free), plus whatever its provider charges. If it uses a Business Solution Provider, that provider may add a platform fee or a per-message markup. The full breakdown is in our WhatsApp API pricing guide.

Limits you will hit

The official API has several separate limits, and they trip people up because each one measures something different.

Limit	What it measures	Where it starts
Messaging limit	Unique users you can message outside a customer service window in a moving 24 hours, per business portfolio	250, then 2,000, 10,000, 100,000, unlimited
Throughput	Messages per second per number, inbound and outbound	80 per second, automatic upgrade to 1,000
Pair rate limit	Messages to the same user	1 every 6 seconds, bursts of up to 45
Per-user marketing limit	Marketing templates a person receives from all businesses	Dynamic, set by WhatsApp
Registered numbers	Numbers a portfolio can register	2, raised to 20

Messaging limits start at 250. You reach 2,000 by verifying your business, by partner-led verification, or by delivering 2,000 template messages outside the window to unique users within 30 days with high-quality templates. After that, Meta raises the limit one level within about 6 hours whenever your quality is high and you used at least half your current limit in the last 7 days. Since October 2025, the limit belongs to the business portfolio and every number shares it. Details are in our guide to WhatsApp API messaging limits.

Throughput is 80 messages per second per number by default. Meta upgrades a number to 1,000 at no cost once the portfolio has an unlimited messaging limit, the number has messaged 100,000 or more unique users outside the window in 24 hours, and its quality is yellow or better. Go over and you get error 130429. Send faster than once every 6 seconds to the same person, beyond the burst allowance, and you get 131056. See our post on WhatsApp API throughput.

Marketing delivery has its own ceiling. WhatsApp limits how many marketing templates any one person receives when they are unlikely to engage, and blocked sends fail with error 131049. As of October 2026, Meta's per-user limits page also says marketing templates are not delivered to users with US phone numbers.

Quality ties it together. WhatsApp scores your messages on the last seven days of user feedback, weighted toward recent days: blocks, reports, mutes and archives. Low quality pauses templates and stalls limit increases.

What changed in 2025 and 2026

If you last looked at the WhatsApp API two years ago, a lot has moved. In order:

July 1, 2025: per-message pricing replaced the old 24-hour conversation pricing.
October 7, 2025: messaging limits moved from each phone number to the business portfolio.
October 23, 2025: the last On-Premises API version expired. Messages to or from numbers still on it are not delivered.
January 15, 2026: Meta's Business Solution Terms bar general-purpose AI assistants from AI model providers. Businesses using AI for their own customer service are still allowed. See our post on the WhatsApp AI chatbot policy.
April 2026: business-scoped user IDs (BSUIDs) started appearing in webhooks, ahead of usernames. From July 2026 you can send to a BSUID with the recipient field. Our BSUID guide covers the schema changes.
June 2026: Meta Business Agent launched globally, and business username reservations opened on June 29.
September 23, 2026: the WhatsApp Business Account began splitting into WhatsApp accounts and Messaging accounts.
October 1, 2026: service messages and in-window utility templates became chargeable.

Two dates are still ahead. Per Meta's Marketing Messages API page, Messaging accounts created on or after April 13, 2027 cannot send marketing messages through the Cloud API, and the Cloud API stops supporting marketing messages entirely on October 13, 2027. Marketing moves to the Marketing Messages API.

The Groups API also arrived. It is open to businesses with an Official Business Account, lets them create invite-only groups of up to 8 participants, and cannot read or join groups the number is already in. Our post on sending to a WhatsApp group by API compares it with linked-number options.

How to get official access

There are three ways onto the official platform, and they lead to the same Cloud API underneath.

Direct with Meta. Create an app in Meta for Developers, add the WhatsApp product, send test messages from the free test number, then add your real number, create a system user token and attach a payment method. You build and host everything. Our Cloud API setup walkthrough goes step by step.
Through a Business Solution Provider. Meta partners such as Twilio, 360dialog, Gupshup and Infobip onboard you and bill you their own way on top of Meta's rates. Many providers also bundle an inbox, chatbot builder or campaign tool. Compare them in our roundup of the best WhatsApp API providers.
Inside a SaaS tool. Many CRMs and helpdesks are Meta Tech Providers. You click connect, complete Meta's Embedded Signup popup, and the tool gets access to your accounts.

Whichever route you take, you need a business portfolio, a phone number you own that can receive an SMS or voice call, a display name that follows Meta's guidelines, a payment method and a plan for opt-in. The number must not be active on WhatsApp, unless you use coexistence, which lets a WhatsApp Business app number join the Cloud API while staying usable in the app. Coexistence has limits: a fixed 20 messages per second, no group chats through the API, and history import of up to 180 days. Our guide to WhatsApp coexistence covers it, and how to get the WhatsApp API compares all three routes.

Linked-number APIs: when they fit

A linked-number API is the right tool when the work is conversations rather than broadcasts. It connects to an existing WhatsApp account as a linked device, so your number, your chat history and your groups come with it, and the phone keeps working.

What you gain:

No new number and no migration. Customers keep messaging the number they already have saved.
Groups. You can read and post in the groups your number belongs to, which the official API cannot touch.
No templates. You can message anyone your number can message, without approval or categories.
Predictable cost. Most charge a flat subscription rather than per message.

What you give up:

Meta's endorsement. These tools are not part of the WhatsApp Business Platform. WhatsApp can restrict or ban a number that sends spam, whatever software sent it. See why WhatsApp bans numbers.
Speed. Good linked-number tools pace sends deliberately, often several seconds apart, to look like a person typing. That rules out OTPs and minute-by-minute alert volume.
Rich features. No interactive buttons, list messages, Flows or green tick.
Independence from the phone. WhatsApp logs out linked devices if the main phone stays offline too long.

Open-source libraries that reverse-engineer WhatsApp Web carry more risk again, because protocol changes can break them overnight. Our post on the unofficial WhatsApp API covers how they work, and WhatsApp API without templates looks at the trade-offs of skipping approval.

Choosing a route

Pick by the job, not by the vendor. Plenty of businesses run both: the official API for codes and alerts, and a linked-number workspace for the human conversations.

The job	Best route
Login codes and OTPs	Official API, authentication templates
Order, shipping and appointment alerts at volume	Official API, utility templates
Marketing campaigns to large opted-in lists	Official platform, Marketing Messages API
A team answering customers on the number they already use	Linked-number workspace, or the official API plus an inbox tool
Working the WhatsApp groups you are already in	Linked-number API
A few dozen personal follow-ups a day with existing contacts	Linked-number API, paced
A verified blue tick	Official API, Official Business Account
Your SaaS product offering WhatsApp to its customers	Official API as a Tech Provider; linked-number APIs for groups and existing numbers

For a small business, the free WhatsApp Business app may still be enough. Our guide on whether a small business needs the WhatsApp API has a decision table, and WhatsApp Business app vs API compares the two side by side.

Where Tenashi fits

Most teams who search for a WhatsApp API want something unglamorous: everyone answering from one place, on the number customers already use, with a record of every chat and the groups included. That is the problem Tenashi solves. You link your existing WhatsApp or WhatsApp Business number with a QR scan, like WhatsApp Web, and your team works one shared inbox of DMs and groups with a CRM under every chat: contacts, deals, a pipeline, follow-ups, tickets with SLAs and notes.

For developers, every paid plan includes the Tenashi API. POST /api/v1/messages sends to a phone number, or to an existing DM or group by conversationId. Signed webhooks fire on message.received, message.sent, message.delivered, message.read and message.failed, and anything your code sends appears in the team inbox so whoever picks up the chat sees the full history. There are no templates and no per-message fees; plans start from $18/mo.

The honest limit: Tenashi is not Meta's WhatsApp Business Platform and not a Meta Business Solution Provider. Sends are paced at one every 4 to 12 seconds per number, with 50 new chats per number per day through the API, so it is the wrong tool for OTPs, high-volume alerts or a green tick. Ban protection lowers risk on your number; it cannot guarantee WhatsApp never acts on it.

Read the API docs · Get started

Every WhatsApp API guide

Every guide in this series, grouped by topic.

The basics

Pricing and costs

Getting access and setup

Limits, quality and policy

Templates and message types

Sending, receiving and webhooks

Code tutorials and no-code tools

Use cases

Unofficial APIs and your own number

Providers and comparisons

FAQ

Is the WhatsApp API free?

Access to Meta's Cloud API is free, but delivered messages are charged by category and the recipient's country. Inbound messages are free, as are messages in a free entry point window and the first 1,000 service messages per number each month since October 1, 2026. Providers may add their own fees, and linked-number tools usually charge a flat subscription.

What is the difference between the WhatsApp Business app and the API?

The Business app is a free phone app for one business number, used by people tapping replies, with up to four linked devices. The API lets software send and receive messages, connect to CRMs and handle volume. The official API needs templates to start chats and bills per message; linked-number APIs automate an app account instead.

Can I use my existing WhatsApp number with the API?

With the official Cloud API, only if you delete it from WhatsApp first, or use coexistence for a WhatsApp Business app number, which keeps the app working with limits. Personal WhatsApp numbers have no coexistence option. Linked-number APIs connect your existing number by QR scan, and the phone keeps working as normal.

Can the WhatsApp API send messages to groups?

The official Groups API lets Official Business Accounts create new invite-only groups of up to 8 participants. It cannot read or post in groups your number already belongs to. Linked-number APIs, including Tenashi, can post into existing groups your number is in, because they operate the account itself rather than a separate platform registration.

Do I need a developer to use the WhatsApp API?

To call the Cloud API directly, yes: someone has to handle tokens, webhooks, templates and hosting. Most businesses skip that by using a provider or SaaS tool that wraps the API in a dashboard. A linked-number workspace needs no developer for daily use, and its API is there when you want custom automations.

Is using an unofficial WhatsApp API allowed?

WhatsApp's terms of service prohibit using the service through automated means in unauthorized ways, and forbid bulk and auto-messaging. Meta does not endorse unofficial APIs, and WhatsApp can ban numbers it sees spamming. Careful pacing, messaging only people who know you and skipping cold bulk outreach reduce that risk without removing it.

If your WhatsApp work is mostly people talking to people, start with your own number and a shared inbox, then add code where it saves time. See every Tenashi feature.

Related guides