The WhatsApp Business API gives businesses programmatic access to WhatsApp messaging — sending transactional notifications, handling inbound customer messages, running automated conversation flows, and delivering appointment reminders, order updates and payment alerts to customers’ WhatsApp accounts. With over 2 billion active users globally and exceptionally high open rates, WhatsApp is increasingly the preferred messaging channel for customer communications. This guide covers how the WhatsApp Business API works, what the approval process involves, and what a properly built integration looks like.
WhatsApp Business app vs WhatsApp Business API
These are two entirely different products and the distinction matters.
The WhatsApp Business app is a mobile app for small businesses to manage customer conversations manually. One user, one device, manual message handling. It’s free, quick to set up, and works for businesses handling a handful of WhatsApp conversations per day. It has no API and cannot be integrated with other systems programmatically.
The WhatsApp Business API (now Meta’s Cloud API) is a programmatic interface for sending and receiving WhatsApp messages at scale, integrated directly with your platform. There is no app interface — messages are sent and received through API calls from your server. It supports multiple users, automated message sending, template-based transactional notifications, inbound webhook handling and CRM integration. This is what a custom integration uses.
A phone number registered with the WhatsApp Business app cannot be simultaneously used with the WhatsApp Business API. If you currently use a number with the WhatsApp Business app and want to use the API, that number needs to be migrated.
Meta Cloud API vs Business Solution Providers
There are two routes to accessing the WhatsApp Business API: directly through Meta’s Cloud API, or through a Business Solution Provider (BSP) — a Meta-approved third party that provides a layer on top of the API.
Meta Cloud API (direct) is the newer route, available since 2022. You access the API directly through Meta’s infrastructure, manage your own WhatsApp Business Account (WABA), submit templates directly to Meta, and pay Meta’s per-conversation pricing directly. This is the recommended route for new integrations — no BSP markup, direct relationship with Meta, full control over your account and data.
Business Solution Providers (BSPs) like Twilio, MessageBird, 360dialog and others provide a managed layer on top of the WhatsApp API. They handle some of the Meta verification and setup complexity, but charge a markup on top of Meta’s conversation rates. For businesses that want managed infrastructure rather than self-managed API access, a BSP can make sense. For most custom integrations, the Cloud API direct route is more cost-effective.
How WhatsApp Business API authentication works
The WhatsApp Cloud API uses a system user access token from your Meta Business account. You create a Meta Developer App, link it to your WhatsApp Business Account, and generate a permanent system user access token. This token is included as a Bearer token in the header of every API request.
The token must be stored server-side and rotated periodically. Meta access tokens can expire or be revoked if account settings change, so the integration needs to handle authentication errors gracefully — logging the error, alerting your team and failing cleanly rather than silently dropping messages.
Message templates and the approval process
This is the most distinctive aspect of the WhatsApp Business API compared to SMS. All outbound messages sent outside an active conversation must use pre-approved templates. You cannot send a free-form message to a customer who hasn’t messaged you first.
Templates are created in Meta Business Manager and submitted to Meta for review. Each template has a category (utility, authentication, or marketing), a language, and a body with optional header, footer and buttons. Variable placeholders in the template are filled with dynamic values when the message is sent — customer name, order number, appointment date, and so on.
Template approval typically takes a few minutes to a few hours for utility and authentication templates. Marketing templates face stricter review and may take longer. Rejected templates can be revised and resubmitted with the feedback Meta provides.
Once approved, templates are available to use immediately through the API. Each send call specifies the template name, language and the values for each variable placeholder. Getting the variable count and types right is important — a mismatch between the template definition and the send call produces an API error.
The 24-hour customer service window
When a customer sends a message to your WhatsApp Business number, a 24-hour service window opens. Within this window, you can send free-form messages — you don’t need to use a pre-approved template. This is the customer support use case: a customer contacts you via WhatsApp, you (or your automated system) can reply with free-form messages for up to 24 hours after their last message.
After the 24-hour window closes, you can only send template messages again. If you need to re-engage a customer after the window, you must use an approved template — typically a re-engagement or follow-up template.
Understanding the window is important for designing the right conversation logic. An integration that tries to send a free-form message outside the window will get an API error. The integration needs to track whether a conversation window is open for each customer and choose the appropriate message type accordingly.
Conversation-based pricing
WhatsApp charges per conversation, not per message. A conversation is a 24-hour window opened by either a business-initiated or user-initiated message. All messages within that 24-hour window are included in a single conversation charge — whether you send 1 message or 20 in that window, it’s one conversation charge.
Conversation categories have different rates: utility conversations (transactional updates, order confirmations) are cheaper than marketing conversations, which are cheaper than authentication conversations in some regions. User-initiated conversations (where the customer messages first) have a lower rate than business-initiated conversations.
Meta provides a free tier of 1,000 conversations per month. Beyond that, UK rates are typically a few pence per conversation. For most transactional use cases, the cost is very competitive with SMS — and often cheaper per customer interaction since multiple messages within a 24-hour window count as one conversation.
For the full service details and pricing, see the WhatsApp Business API integration service. For how WhatsApp compares with SMS, see WhatsApp vs SMS for business messaging. For appointment reminders specifically, see WhatsApp appointment reminders. For what the build costs, see the WhatsApp Business API integration cost guide.
Related posts
- WhatsApp vs SMS for business messaging
- WhatsApp appointment reminders for UK businesses
- WhatsApp Business API setup: the approval process explained
- WhatsApp Business API integration cost
Webhook handling for inbound messages
When a customer sends a message to your WhatsApp Business number, Meta sends a webhook event to an endpoint on your server. The webhook payload contains the sender’s phone number, the message content (text, media, interactive response or reaction), and metadata including a message ID for deduplication.
A well-built integration processes each webhook event explicitly: extracting the message content, identifying the customer in your system by their phone number, routing the message to the right handler based on the message type and conversation state, and sending an appropriate reply either as a free-form message (within the 24-hour window) or triggering a template message.
Webhook verification is required by Meta. When you first configure a webhook URL, Meta sends a challenge request that your endpoint must respond to correctly to verify ownership. Subsequently, Meta signs webhook payloads with your app secret and the integration should verify this signature on every incoming request before processing the message.
Message deduplication is important for production integrations. Meta may occasionally send the same webhook event more than once. The integration should store processed message IDs and check for duplicates before processing — preventing a customer’s message from triggering multiple responses if the same webhook fires twice.
Media messages
The WhatsApp Business API supports sending and receiving media: images, documents, audio, video and location. Template messages can include media headers — an image or document at the top of the message before the body text. This is useful for sending PDF invoices, shipping labels, or product images alongside the notification text.
Media sent via the API is first uploaded to Meta’s media servers and an ID is returned. This ID is then referenced in the message send call rather than including the full file. Media IDs expire after 30 days, so files that need to be sent repeatedly (logo images in template headers, for example) need to be re-uploaded periodically or hosted on a URL that Meta can retrieve at send time.
Interactive messages and buttons
WhatsApp supports interactive message types — reply buttons, list messages and call-to-action URL buttons — that give customers tap-able options rather than requiring them to type a response. A template with reply buttons (up to 3) allows a customer to confirm or cancel an appointment with a single tap rather than typing YES or NO. List messages present a menu of options for the customer to choose from.
Interactive responses come back through the webhook as structured data — not free-form text that needs to be parsed, but a button reply with the button ID and title the customer selected. This makes conversation logic much cleaner to implement than parsing free-form text responses.
If you need help with a custom API integration for your website or business application, I can help. I build bespoke API integrations for UK businesses. See API integration pricing or get in touch to discuss your project.
Need a custom integration built?
I build custom API integrations — Stripe, Companies House and bespoke data pipelines. Reliable, well-documented, no agency overhead.
Discuss your project →