Get started
Connect WhatsApp
The essentials that apply to both providers. Read this once, then follow the setup page for Meta or Twilio.
// endpoints
The webhook URLs
Each provider has its own inbound endpoint. Both live outside the /api prefix. Your workspace shows the exact, copy-ready URL on Admin → Channels; the paths are:
| Provider | Webhook path |
|---|---|
| Meta | /webhooks/whatsapp |
| Twilio | /webhooks/twilio/whatsapp |
Setup steps live on the provider pages: Meta setup · Twilio setup.
// policy
The 24-hour session window
On both providers, free-form replies are only allowed within 24 hours of the customer's last message. Outside that window a send is marked window closed and requires an approved template. This is WhatsApp policy, not a SupportWize limit.
// automatic
What you get automatically
- Reply buttons. Native interactive buttons on Meta; on Twilio, SupportWize registers a quick-reply Content template on your account on first use and reuses it — you never manage templates. If Twilio's Content API is briefly unavailable, buttons degrade to a numbered text menu so sends never fail.
- Inbound media (images, audio, video, documents, location) is fetched with your credentials and shown to the agent — no config either way.
- Unified identity. Twilio's
whatsapp:+234…and Meta'swa_idnormalize to the same customer, so history follows the number.
// security
How inbound is authenticated
| Provider | Verification |
|---|---|
| Meta | A one-time verify-token handshake confirms the callback URL, then every POST is validated by an HMAC-SHA256 signature (X-Hub-Signature-256) over the raw body. |
| Twilio | Every POST is validated by recomputing the HMAC-SHA1 signature (X-Twilio-Signature) over the exact URL + sorted form fields using your Auth Token. |
Requests that fail verification are rejected — a forged webhook can't create tickets. Tokens and secrets are write-only: encrypted at rest and never shown again after saving.
// verify
Test & go live
- Inbound: message the business number from a personal WhatsApp — a conversation should appear in seconds.
- Outbound: reply from the agent view; it should arrive on WhatsApp.
- Status: the ticks (sent → delivered → read) should update.
- Connection check: the channel card's Test action calls the provider live and reports status.
Something not working? See Troubleshooting.
https://<your-workspace>.ondigitalocean.app/webhooks/whatsapp