A REST API with per-account keys, HMAC-signed outbound webhooks and a generic inbound endpoint. Everything sends from the number you linked.
What developers get
REST API & API keys — create and revoke keys in Settings; authenticate with an Authorization: Bearer header, X-API-Key, X-Access-Token or an access_token query parameter.
Rate limit — 120 requests per minute per key, with stricter limits on login and OTP endpoints.
Outbound webhooks — message sent, delivered, read, received and failed, HMAC-SHA256 signed with event, timestamp and signature headers.
Retries — a failed delivery is retried after 5 seconds, 30 seconds and 5 minutes.
Generic inbound webhook — any tool that can POST JSON can create contacts and trigger messages.
WhatsApp OTP — send, verify, resend and check one-time codes. See the OTP page.
Messages send from your own WhatsApp number, linked by scanning a QR code the way WhatsApp Web is linked. This is not the official WhatsApp Business API: there is no Meta approval queue and no template review, and in exchange the linked phone must stay online and only people who opted in should be messaged. See how it works.