WhatsApp Business API integration built like production software

Direct Cloud API or a BSP?

Since 23 October 2025 every integration runs on Meta’s Cloud API. The real choice is whether you connect to it directly or through a Business Solution Provider (BSP) or reseller.

Ask any BSP four questions: do you mark up Meta’s per-message fees or pass them through; can we export contacts and conversation history; can we move our number to another provider; and will you forward raw webhooks to our systems?

Pricing in one paragraph

Since 1 July 2025 Meta charges per delivered message, by category and country. Since 1 October 2026, service messages (free-form replies inside the 24-hour customer service window) are charged after 1,000 free per business phone number per month, and utility templates sent inside that window are no longer free. On Meta’s INR rate card effective 1 October 2026, India costs ₹0.8631 per marketing message and ₹0.115 per utility, authentication or service message, plus GST. Indian businesses must move their accounts to INR billing by 31 December 2026, after which Meta stops delivering messages for non-INR accounts. Meta can revise rates each quarter, so check Meta’s current rate card before you budget. Our post on WhatsApp chatbot rules and costs in India works through examples.

Template categories and the recategorisation trap

Outside the 24-hour window, business-initiated messages must use an approved template in one of three categories:

• Marketing: promotions, offers, re-engagement, and anything that is not clearly one of the other two.
• Utility: updates about a specific transaction or account the customer started, such as an order, booking, payment or report.
• Authentication: one-time passcodes.

The pitfall is that Meta decides the category. Since 9 April 2025, a template submitted as utility that Meta judges to be marketing is approved as marketing. Approved utility templates can also be moved to marketing later, normally with a day’s notice. A template that mixes an order update with an offer counts as marketing. On the current India rate card that is more than seven times the utility price. Keep utility templates strictly transactional, put promotions in separate templates, and subscribe to template-status webhooks so a change raises an alert, not a surprise invoice.

Architecture: webhook, queue, workers, CRM

1. Verify. The endpoint answers Meta’s subscription check (hub.mode, hub.verify_token, hub.challenge). For every event it checks the X-Hub-Signature-256 header, an HMAC-SHA256 of the raw request body keyed with your app secret, and rejects anything that does not match.
2. Acknowledge fast. Write the payload to a queue and return 200 straight away. Meta retries failed or slow deliveries for up to 7 days, so a slow CRM call inside the handler turns into a stream of duplicates.
3. Make it idempotent. Every message and status carries an ID. Workers record processed IDs under a unique constraint and skip repeats, so a retried webhook never opens a second ticket or sends a second reply.
4. Process in workers. Workers update the CRM, run the chatbot and send replies, retrying with exponential backoff on server and rate-limit errors, with a dead-letter queue for anything that keeps failing.
5. Do not trust ordering. Store each status with its timestamp and never move a message backwards from read to delivered.
6. Observe. Log every send and event against the WhatsApp message ID, and alert on rising failure rates and template-status changes.

Short notes for developers:

• Node.js: keep the raw body on the webhook route (for example express.raw({ type: 'application/json' })), compare signatures with crypto.timingSafeEqual, and push events to BullMQ or SQS.
• PHP: read file_get_contents('php://input') before anything parses it, compare with hash_equals() against 'sha256=' . hash_hmac('sha256', $raw, $secret), and in Laravel dispatch a queued job and return.
• Python: in FastAPI or Django, read the raw body bytes, verify with hmac.compare_digest, and hand off to Celery, RQ or a cloud queue.

AI chatbots and Meta’s 2026 rules

From 15 January 2026, Meta’s business terms bar AI providers from using the WhatsApp Business API when AI is the primary, rather than incidental or ancillary, functionality on offer, as TechCrunch reported. General-purpose assistants were the target; bots that support a business’s own customers remain allowed. In June 2026 the European Commission ordered Meta, as an interim measure, to restore access for rival assistants in the EU while it investigates, so check the position in each market. For a clinic, shop or lender, the practical rule is simple: keep the bot about your own services.

SMS fallback in India and DLT registration

Under TRAI’s commercial-communication regulations, a business sending commercial SMS in India registers as a principal entity on an operator’s DLT platform, registers its sender headers and registers every message template. Messages that do not match a registered template are blocked. So your fallback SMS must match a registered template, variables included. Map each WhatsApp template to its DLT twin, trigger fallback on a failed status or no delivery within a set time, and share one opt-out list across both channels.

Opt-in and consent records

WhatsApp’s business messaging policy requires opt-in permission before you message someone, and every request to opt out, on or off WhatsApp, must be respected. India’s DPDP Act adds that consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give; most of the related rules apply from May 2027. For every contact we store who agreed, when, on which channel, for what purpose, the exact wording shown, where it was captured (form, QR code, chat) and any withdrawal. That record is what you show a regulator, or Meta, when a complaint arrives.

What drives the cost

• Meta’s fees: your mix of marketing, utility, authentication and service messages, and how many service replies exceed the free allowance.
• BSP fees, if you use one: plan fees and any markup on messages.
• Integration depth: one CRM is modest work; several systems of record with two-way sync is not.
• Chatbot scope: structured flows cost less to build and run than open-ended AI conversations.
• Fallback: SMS charges and DLT template upkeep.

Common mistakes

• Processing webhooks synchronously, then fighting duplicates.
• Skipping signature verification because “the URL is secret”.
• Mixing a discount into a reminder and losing the utility rate.
• Keeping opt-outs per channel instead of per person.
• Putting diagnoses or account details in template text.

How to choose a WhatsApp integration partner

• They explain the direct-versus-BSP trade-off for your case, and say when a ready-made tool is enough.
• They can show webhook code with signature checks, queues and idempotency.
• They track template categories and Meta’s quarterly pricing changes.
• They design consent records for DPDP and opt-out handling across channels.
• You own the WhatsApp Business account, the phone number and the code.