Documentación de la API REST REST API Documentation

{
  "event": "message.inbound",   // o "message.outbound"
  "account_id": 1,
  "timestamp": "2026-08-20T18:30:00.000Z",
  "message": {
    "id": 1234,
    "wa_id": "3EB0C234D1...",
    "jid": "34612345678@s.whatsapp.net",
    "conversation_name": "Juan García",
    "direction": "in",
    "body": "Hola, necesito ayuda",
    "type": "text",
    "status": "received",
    "timestamp_unix": 1724177400,
    "sender_jid": null,        // solo en grupos
    "sender_name": null       // solo en grupos
  }
}

const crypto = require('crypto');

function verifySignature(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)           // body como string o Buffer
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// En tu endpoint:
const sig = req.headers['x-wa-signature'];
if (!verifySignature(req.rawBody, sig, 'TU_SECRET')) {
  res.status(401).send('Firma inválida');
}

import hmac, hashlib

def verify_signature(body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

{
  "method": "POST",
  "url": "https://tudominio.com/wa-api/api/v1/send",
  "authentication": "genericCredentialType",
  "genericAuthType": "httpHeaderAuth",
  // Credencial: Name = "Authorization", Value = "Bearer wam_..."
  "bodyParametersJson": {
    "account_id": 1,
    "to": "{{ $json.phone }}",
    "body": "{{ $json.message }}"
  }
}

const WA_API_KEY = process.env.WA_API_KEY;
const BASE_URL   = 'https://tudominio.com/wa-api/api/v1';

async function sendWhatsApp(accountId, phone, message) {
  const res = await fetch(`${BASE_URL}/send`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${WA_API_KEY}`,
    },
    body: JSON.stringify({ account_id: accountId, to: phone, body: message }),
  });
  if (!res.ok) throw new Error(await res.text());
  return res.json();
}

// Uso:
sendWhatsApp(1, '34612345678', 'Hola desde Node.js!')
  .then(r => console.log('Enviado:', r.wa_id));

from flask import Flask, request, abort
import hmac, hashlib, json

app = Flask(__name__)
WA_SECRET = "mi_secreto_hmac"

@app.route('/webhook/whatsapp', methods=['POST'])
def wa_webhook():
    sig = request.headers.get('X-WA-Signature', '')
    expected = hmac.new(
        WA_SECRET.encode(), request.data, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(sig, expected):
        abort(401)

    data = request.get_json()
    msg = data['message']
    print(f"Mensaje de {msg['jid']}: {msg['body']}")

    # Procesa aquí: guarda en BD, notifica al agente, etc.

    return '', 200   # ← responder siempre 200 rápido

<?php
$apiKey  = 'wam_TU_API_KEY';
$baseUrl = 'https://tudominio.com/wa-api/api/v1';

function sendWhatsApp($accountId, $phone, $message): array {
    global $apiKey, $baseUrl;
    $ch = curl_init("$baseUrl/send");
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            "Authorization: Bearer $apiKey",
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => json_encode([
            'account_id' => $accountId,
            'to'         => $phone,
            'body'       => $message,
        ]),
    ]);
    $body = curl_exec($ch);
    curl_close($ch);
    return json_decode($body, true);
}

$result = sendWhatsApp(1, '34612345678', '¡Hola desde PHP!');
echo 'wa_id: ' . $result['wa_id'];

{
  "error": "API key no encontrada o revocada"
}