Send text & template
send_text and send_template methods call the Graph API messaging endpoint and return a provider message ID when the client is configured.
WhatsApp Business API
The official Cloud API path is wired in. Live messaging needs your provider setup.
Wavy's backend includes a Meta WhatsApp Business Cloud API client, webhook receiver, template submission, and message-status tracking. The source path exists, but sending real messages requires a registered WABA, a phone-number ID, a server-configured access token, and verified webhooks. Without those, the client reports an unconfigured state and runs in dry-run mode.
Status: Configuration-dependentSource path exists and is workspace-scoped. Live sends require server credentials and Meta provider setup.
No BSP partnership claimedAutomix is not a Meta Business Solution Provider. You bring your own WABA and access token.
Dry-run by defaultWhen credentials are absent the client returns a synthetic message ID instead of calling Meta.
How the connection works
The exact workflow from channel record to delivered message.
This is the real path in the codebase — not a marketing summary. Each step maps to a backend route or service method.
- Create a channel record — In Wavy, a channel is a workspace-scoped record storing display name, phone number, phone-number ID, and WABA ID. The
/api/v1/channelsroute owns this. It does not store your Meta access token — that remains a server environment variable. - Server credential configuration — The
WhatsAppClientreadsMETA_PHONE_NUMBER_IDandMETA_ACCESS_TOKENfrom deployment settings. A self-service per-workspace credential vault is not implemented; do not paste access tokens into chat or ordinary form fields. - Webhook verification — Meta calls a
/webhooks/metaendpoint for inbound messages and status receipts. The verifier uses constant-time HMAC comparison against an app secret. When the app secret is absent, verification is lenient for development only — it is not safe for production. - Template submission — Message templates are created locally then submitted to Meta via the templates API. Status transitions are LOCAL → PENDING → APPROVED or REJECTED. Only APPROVED templates may be used in campaign launches.
- Send and track — Outbound sends go through
send_textorsend_template. The response carries a provider message ID. Status receipts (queued, sent, delivered, read, failed) arrive via webhook and update the message record.
What you need
Requirements before any real message is sent.
These are Meta's and the codebase's real prerequisites — not a checklist we invented.
- A verified Meta Business Manager — You need a Business Manager account with a verified business. Automix does not provide one or act as a BSP.
- A WhatsApp Business Account (WABA) — A registered WABA with an approved phone number. Display-name changes and message-template review are governed by Meta, not Wavy.
- Server environment variables —
META_ACCESS_TOKENandMETA_PHONE_NUMBER_IDare required for the client to report configured.META_APP_SECRETis required for production webhook signature verification, andMETA_WABA_IDis required for template listing and submission. - Verified webhook URL — A publicly reachable HTTPS endpoint that Meta can call. The
app_secretmust be configured for production-grade signature verification. - Approved message templates — Business-initiated conversations require Meta-approved templates. The backend enforces that only APPROVED templates can be attached to a campaign.
Safeguards
What the codebase does to keep messaging honest.
These are built-in safety behaviours, not promises.
- Dry-run fallback — When the client is unconfigured, sends return a synthetic message ID instead of calling Meta. This prevents silent failures from looking like successful deliveries.
- Template gating — Campaigns reference templates by ID; the launch path checks template status and rejects non-APPROVED templates before enqueueing recipients.
- Status transparency — Message records carry a status field that reflects the real provider state: queued, sent, delivered, read, or failed. The UI does not fabricate a "delivered" state.
- Webhook signature verification — Inbound webhooks are verified with constant-time HMAC comparison. When the app secret is missing, the system is explicitly flagged as dev-only — it does not silently accept unverified traffic as if it were safe.
- Workspace isolation — Channels, contacts, and conversations are workspace-scoped. A channel record in one workspace cannot send on behalf of another.
What the API path covers
Five backend capabilities behind the connection.
Inbound webhook receiver
A /webhooks/meta route receives inbound messages and status updates, verifies signatures, and persists them to the conversation and message tables.
Template lifecycle
Templates are created locally, submitted to Meta, and tracked through PENDING → APPROVED / REJECTED. Only APPROVED templates are campaign-eligible.
Message status tracking
Receipts from Meta update each message's status. The workspace inbox shows queued, sent, delivered, read, and failed as distinct states.
Dry-run safety
Unconfigured sends return a synthetic ID and do not call Meta. This keeps local development and unconfigured deployments from masquerading as live sends.
Questions
WhatsApp Business API — straight answers.
Is Wavy a Meta Business Solution Provider?
No. Automix is not a BSP. You register and verify your own WABA and phone number with Meta, then configure the server credentials. Wavy provides the client and workflow, not the Meta account.
Can I start sending messages right after signing up?
Not without provider setup. The backend path exists, but live sends require a registered WABA, a phone-number ID, a server-configured access token, and a verified webhook. Until those are in place, the client runs in dry-run mode.
Where is my Meta access token stored?
In the server environment as a deployment setting. A self-service per-workspace credential vault is not implemented. Do not paste access tokens into chat or ordinary form fields.
What happens if I send without credentials configured?
The WhatsAppClient reports an unconfigured state and returns a synthetic message ID. No call is made to Meta. This is intentional so that development and unconfigured deployments do not appear to send live messages.
Do you handle Meta policy compliance or message approvals?
No. Wavy submits templates to Meta and tracks their status, but Meta governs approval, display-name changes, and policy enforcement. Automix does not claim to guarantee approval or manage your Meta policy standing.
Is webhook signature verification production-safe?
Only when the app secret is configured. The verifier uses constant-time HMAC comparison. When the app secret is absent, verification is lenient for development only and the system is not safe for production traffic.
Bring your WABA, configure the server, and connect.
The API path is wired in and workspace-scoped. Live messaging starts when your Meta credentials and webhook are configured.