📱 WhatsApp API — Integration Guide

Everything you need to integrate WhatsApp messaging into your application.

📑 Table of Contents

1. Overview & Authentication

This API lets you manage WhatsApp instances and send/receive messages programmatically. There are two authentication keys you'll use:

KeyPurposeHow to pass it
API Key Your client identity. Used to create instances and list your instances. Authorization: Bearer <api_key> or ?api_key=YOUR_KEY
Instance Token Per-instance access. Returned when you create an instance. Used for all operations on that instance. Authorization: Bearer <token> or ?token=YOUR_TOKEN
💡 Keep your tokens safe! Your API key is like a password. The instance token grants full access to that WhatsApp instance. Never expose them in client-side code.

Base URL:

2. Quick Start

Here's the typical flow to get a WhatsApp instance running:

  1. Create an instance → you receive an instance token
  2. Get the QR code → display it to the user
  3. User scans QR with their WhatsApp → instance becomes connected
  4. Send messages using the instance token
  5. Receive messages via webhooks

3. Create Instance

POST /api/instance/{instanceId}/init

Creates a new WhatsApp instance. Uses your API Key.

curl -X POST {BASE_URL}/api/instance/my_clinic_wa/init \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "dr_smith"
  }'

Response:

{
  "success": true,
  "message": "Instance created successfully",
  "instanceId": "my_clinic_wa",
  "userId": "dr_smith",
  "token": "a1b2c3d4e5f6789...your_instance_token"
}
⚠️ Save the token! This is the only time the token is returned. Store it securely — you'll need it for all subsequent API calls to this instance.

4. Get QR Code

GET /api/instance/{instanceId}/qr?format=base64

Retrieves the QR code image for the user to scan with WhatsApp. Uses Instance Token.

curl "{BASE_URL}/api/instance/my_clinic_wa/qr?format=base64&token=YOUR_INSTANCE_TOKEN"

Response:

{
  "success": true,
  "qrCode": "data:image/png;base64,iVBORw0KGgo...",
  "status": "qr_ready",
  "format": "base64"
}

Formats: base64 (PNG as data URL), svg, terminal, raw

Tip: Display the base64 QR directly in an <img> tag: <img src="${qrCode}">. Poll this endpoint every 5 seconds until status changes to connected.

5. Check Instance Status

GET /api/instance/{instanceId}/status

curl -H "Authorization: Bearer YOUR_INSTANCE_TOKEN" \
  "{BASE_URL}/api/instance/my_clinic_wa/status"

Response:

{
  "success": true,
  "instanceId": "my_clinic_wa",
  "status": "connected",
  "userInfo": {
    "name": "Dr Smith Clinic",
    "number": "60123456789"
  }
}
StatusMeaning
connectingInstance is starting up
qr_readyQR code available — waiting for scan
connectedWhatsApp authenticated and ready
disconnectedSession ended or phone disconnected

6. Send Text Message

POST /api/instance/{instanceId}/messages/send

curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/messages/send?token=YOUR_INSTANCE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "60123456789",
    "type": "text",
    "message": "Hi! Your appointment is confirmed for tomorrow at 10am."
  }'

Response:

{
  "success": true,
  "messageId": "3EB01A2B3C4D5E6F",
  "timestamp": "2026-03-23T10:30:00.000Z",
  "to": "60123456789",
  "type": "text"
}
Phone format: Use the full number with country code, without + or spaces. E.g. 60123456789 for Malaysia.

7. Send Media

Image

curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/messages/send?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "60123456789",
    "type": "image",
    "image": {
      "url": "https://example.com/xray-result.jpg",
      "caption": "Your X-ray results"
    }
  }'

Document

curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/messages/send?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "60123456789",
    "type": "document",
    "document": {
      "url": "https://example.com/invoice.pdf",
      "filename": "Invoice_March_2026.pdf",
      "mimetype": "application/pdf"
    }
  }'

Supported types: text, image, video, audio, document

Media can be sent via url (public URL) or data (base64 encoded).

8. Groups

List Groups

GET /api/instance/{instanceId}/groups?token=YOUR_TOKEN

Send to Group

POST /api/instance/{instanceId}/groups/messages/send

curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/groups/messages/send?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "120363025246125789@g.us",
    "type": "text",
    "message": "Reminder: Staff meeting at 3pm today"
  }'

9. Webhooks (Receive Messages)

Register a webhook URL to receive real-time notifications when messages arrive or connection status changes.

Register Webhook

POST /api/instance/{instanceId}/webhook

curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/webhook?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "webhookUrl": "https://your-app.com/api/whatsapp-webhook",
    "events": ["message", "message_ack", "connection_update"]
  }'

Webhook Payload (incoming message)

When a message is received, your webhook URL gets a POST request like:

{
  "event": "message",
  "instanceId": "my_clinic_wa",
  "data": {
    "from": "60123456789",
    "fromName": "Patient John",
    "message": "Hi, I'd like to book an appointment",
    "messageType": "text",
    "timestamp": 1711180200,
    "messageId": "3EB0..."
  }
}
EventDescription
messageNew incoming message
message_ackMessage delivery/read receipt
connection_updateInstance connected/disconnected
qr_updatedNew QR code generated

10. Disconnect / Delete Instance

Disconnect (Logout)

POST /api/instance/{instanceId}/logout?token=YOUR_TOKEN

Disconnects WhatsApp. The instance and token remain — you can reconnect by scanning a new QR code.

curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/logout?token=YOUR_TOKEN"

Delete Instance (Permanent)

DELETE /api/instance/{instanceId}?token=YOUR_TOKEN

Permanently removes the instance, its data, and token. Cannot be undone.

curl -X DELETE "{BASE_URL}/api/instance/my_clinic_wa?token=YOUR_TOKEN"

11. List All Your Instances

GET /api/instances

Uses your API Key (not instance token). Returns all instances you've created.

curl -H "Authorization: Bearer YOUR_API_KEY" "{BASE_URL}/api/instances"

12. Error Handling

HTTP CodeMeaning
200Success
400Bad request — missing or invalid fields
401Unauthorized — invalid or missing token/api_key
403Forbidden — token doesn't match instance, client deactivated, or limit reached
404Not found — instance doesn't exist
409Conflict — instance already exists
500Server error

All error responses follow this format:

{
  "success": false,
  "error": "Description of what went wrong"
}