WhatsApp API Without Meta Business Verification (2026 Guide)

Yes. You can use a WhatsApp API without Meta business verification by connecting your own WhatsApp number as a linked device, the way WhatsApp Web connects, instead of going through Meta's WhatsApp Business Platform. Chatmaid Developers runs that connection for you and exposes it as a REST API: scan a QR code once, send messages with a POST request, and receive replies through signed webhooks. There are no message templates and no 24-hour window. As of October 2026 it costs $7.99/month flat for your first number, and the sandbox is free. The tradeoff: it is not an official Meta channel, so there is no verified business badge, and spam-like sending can get a number restricted.

What Meta's official API requires (as of October 2026)

The WhatsApp Business Platform is Meta's sanctioned route. You use it directly through the Cloud API or through a provider built on it, such as Twilio or 360dialog. Business verification is not literally the first step, but the platform is built around a verified business:

• A business portfolio and a WhatsApp Business Account. The first step in Meta's Cloud API setup guide, creating a Meta app with WhatsApp, has you select or create a business portfolio.
• A starter cap. A new business portfolio can message 250 unique WhatsApp users outside the customer service window in a moving 24-hour period. To ask for 2,000, you verify your business (yourself or through a partner) or send 2,000 delivered messages outside service windows within 30 days using high-quality templates; Meta then reviews your message quality before approving the increase (Meta: messaging limits).
• Templates outside the 24-hour window. A customer service window opens for 24 hours when a user messages you. Once it closes, you can only send pre-approved template messages (Meta: sending messages).
• Per-message fees. Meta bills each delivered template message. Since October 1, 2026, it also charges for service messages, the free-form messages you send inside the window, beyond 1,000 free per business phone number per month (Meta: pricing).
• A business number, not a personal one. Twilio needs a number that is not already registered with WhatsApp, and Meta business verification before production, which it warns can take several weeks (Twilio: WhatsApp self sign-up). Some providers, such as 360dialog, can connect a number that stays on the WhatsApp Business app (Meta calls this coexistence), but none lets you keep using a personal WhatsApp number in the regular app (360dialog: coexistence).

That process suits companies sending high volumes of templated notifications under a verified brand name. It is a lot of overhead for:

• A developer who wants their app to send a WhatsApp notification when something happens
• A small business that wants a WhatsApp chatbot without a compliance department
• An AI agent that should deliver its output in WhatsApp instead of email
• An internal tool that alerts the team on WhatsApp when a deploy fails

How a WhatsApp API works without Meta

WhatsApp lets one account run on your phone plus linked devices, such as WhatsApp Web and the desktop app. Open-source libraries speak that linked-device protocol:

• whatsmeow is a Go library for the WhatsApp Web multidevice API.
• Baileys is a WebSocket-based TypeScript library.
• whatsapp-web.js runs WhatsApp Web in a managed browser through Puppeteer.

Running one of these yourself means keeping a long-lived process online, storing session data, reconnecting after drops and keeping up with protocol changes. Chatmaid runs that part and gives you a versioned REST API under /v1, so your endpoints and webhook payloads stay the same when WhatsApp changes its app. You link a number once by scanning a QR code with WhatsApp on your phone. After that, any HTTP client can send through it: your backend, a script or an AI agent. You stay logged in on your phone as usual.

What this enables (and what it doesn't)

What you can do

• Send at any time, with no templates and no 24-hour session window. Text can be up to 4,096 characters.
• Message people who have not written to you first, as long as they expect to hear from you. WhatsApp can occasionally refuse a first message to a brand-new contact; the API reports this as RECIPIENT_NOT_REACHABLE.
• Receive incoming messages in real time through the message.received webhook.
• Send media by passing HTTPS links in mediaUrls: images, documents, audio or video. With a single image, video or document, content becomes its caption; with several files, content is sent as a separate text message first. Audio files carry no caption.
• Send to groups your number belongs to, using a group ID from GET /v1/groups.
• Use several numbers on one account and pick the sender per request with fromPhoneId. The $7.99 plan includes one live number; extra live numbers are a paid add-on (see pricing), and sandbox numbers are free.
• Connect AI agents, either from your own code or through the Chatmaid MCP server for Claude Code, Cursor and Windsurf.

What to be aware of

• No verified business badge. Your number appears as a regular WhatsApp account. Messages look like they came from your phone, with no Chatmaid branding.
• Spam-like sending gets numbers restricted. With normal use, a ban is very unlikely. Restrictions happen when an account behaves like spam, such as unsolicited bulk messages to people who do not have you saved.
• It is not an official Meta channel. Chatmaid is independent and not affiliated with Meta, and you are responsible for following WhatsApp's Terms of Service, which list bulk messaging and auto-messaging among impermissible communications. Build for messages people expect, not cold outreach.
• No interactive buttons or list messages yet. Chatmaid lists them as on the roadmap.

The use cases that fit are messages people expect: service updates, appointment reminders, replies from an AI agent and internal alerts.

Setting up in about five minutes

1. Create an account

Sign up from the Chatmaid Developers page. The sandbox is free and needs no credit card.

2. Create a sandbox API key

In the dashboard, click Create API Key and create a test key. Test keys start with sk_test_, work without a subscription and never touch WhatsApp: sends are simulated, but message.sent webhooks are delivered for real, so you can build and test the sending side first. Incoming messages (message.received) only exist on live numbers. When you are ready to go live, subscribe ($7.99/month) and create a live key, which starts with sk_live_. Both use the same API host; the key prefix decides the environment.

3. Add a phone number

Click Add Number and enter the number in E.164 format, for example +15551234567. A sandbox number connects without a scan. For a live number, a QR code appears: on your phone, open WhatsApp, go to Linked devices, tap Link a device and scan it.

4. Send your first message

fromPhoneId accepts the sender's E.164 number (recommended) or its dashboard ID.

curl -X POST https://developers-api.chatmaid.net/v1/messages/send \
  -H "Authorization: Bearer sk_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "fromPhoneId": "+15551234567",
    "to": "+15557654321",
    "content": "Hello from the API!"
  }'

Response (sandbox key):

{
  "success": true,
  "data": {
    "id": "msg_abc123def456",
    "from": "+15551234567",
    "to": "+15557654321",
    "isGroup": false,
    "groupId": null,
    "content": "Hello from the API!",
    "mediaUrls": [],
    "status": "sent",
    "errorCode": null,
    "errorMessage": null,
    "createdAt": "2026-10-22T10:30:00.000Z",
    "sentAt": "2026-10-22T10:30:00.120Z",
    "deliveredAt": null,
    "readAt": null,
    "failedAt": null
  }
}

In the sandbox, the status is sent straight away. With a live key, the request returns once WhatsApp has accepted the message, also as sent. The status then moves to delivered and read as WhatsApp receipts arrive; read may never come if the recipient has read receipts turned off.

If WhatsApp refuses a live send, you get an HTTP error instead of a 2xx. The body's error field holds a stable code such as RECIPIENT_NOT_REACHABLE (422) or INVALID_RECIPIENT (400), next to the messageId (see the error codes). If the sending number is already disconnected, the request is refused with a 400 before anything is sent. You can look any message up later with GET /v1/messages/msg_abc123def456. If your code retries requests, pass an idempotencyKey of up to 64 characters: a repeat with the same key returns the original result instead of sending twice.

For error handling, rate limits and a go-live checklist, continue with the WhatsApp API quickstart for developers. The API docs cover every endpoint, and the webhooks reference lists the events and payloads.

Receiving incoming messages

On the dashboard's Webhooks page, enter a public HTTPS URL and tick message.received. When you save, the dashboard shows the signing secret (it starts with whsec_), so copy it right away. Regenerate Secret issues a new one if it ever leaks. When one of your live numbers receives a message, Chatmaid posts this to your server:

{
  "event": "message.received",
  "timestamp": "2026-10-22T10:31:09.000Z",
  "data": {
    "messageId": "inmsg_abc123def456",
    "from": "+15557654321",
    "to": "+15551234567",
    "content": "What are your office hours?",
    "type": "text",
    "isGroup": false,
    "groupId": null,
    "receivedAt": "2026-10-22T10:31:08.000Z"
  }
}

from is the person who wrote to you and to is your connected number. type is one of text, image, video, audio, document, sticker, location, contact or other; for media, content holds the caption if there is one. In a group, isGroup is true and groupId holds the group ID, which you can pass as to to reply in the group. Inbound messages exist only on live numbers; sandbox keys never receive them.

Every delivery carries an X-Chatmaid-Event header and an X-Chatmaid-Signature header in the form t=<unix timestamp>,v1=<hex>. The v1 value is an HMAC-SHA256 of <timestamp>.<raw body>, keyed with your webhook secret. If your endpoint does not answer with a 2xx within 30 seconds, Chatmaid retries the delivery over the next few minutes, so the same event can arrive more than once.

Here is a small Express receiver that checks the signature and sends an automatic reply. Install the packages with npm install express @chatmaid/sdk. Set CHATMAID_API_KEY to a live key (sk_live_...): incoming messages only arrive on live numbers, and a test key cannot send from one. Set CHATMAID_WEBHOOK_SECRET to your whsec_ secret, then start the server with node server.mjs (Node 18 or later). Chatmaid only posts to public HTTPS URLs, so while testing on your own machine, expose port 3000 with a tunnel such as ngrok or Cloudflare Tunnel and enter that URL plus /webhooks/chatmaid in the dashboard.

// server.mjs
import crypto from "node:crypto";
import express from "express";
import { Chatmaid } from "@chatmaid/sdk";

const cm = new Chatmaid({ apiKey: process.env.CHATMAID_API_KEY });
const secret = process.env.CHATMAID_WEBHOOK_SECRET;
const handled = new Set(); // use your database in production
const greeted = new Set(); // senders already auto-replied to
const app = express();
const TOLERANCE_SECONDS = 15 * 60; // retries reuse the first attempt's signature

// Header format: t=<unix timestamp>,v1=<hex HMAC-SHA256 of "t.rawBody">
function isValidSignature(rawBody, header) {
  const parts = Object.fromEntries(
    (header ?? "").split(",").map((part) => {
      const i = part.indexOf("=");
      return [part.slice(0, i).trim(), part.slice(i + 1).trim()];
    })
  );
  if (!parts.t || !parts.v1) return false;
  const age = Math.abs(Date.now() / 1000 - Number(parts.t));
  if (!(age <= TOLERANCE_SECONDS)) return false; // stale or replayed delivery

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.`)
    .update(rawBody)
    .digest();
  const provided = Buffer.from(parts.v1, "hex");
  return (
    provided.length === expected.length &&
    crypto.timingSafeEqual(provided, expected)
  );
}

app.post(
  "/webhooks/chatmaid",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const raw = req.body;
    if (!Buffer.isBuffer(raw) || !isValidSignature(raw, req.get("x-chatmaid-signature"))) {
      return res.status(401).end();
    }

    // Acknowledge quickly; do the work after responding.
    res.status(200).end();

    const { event, data } = JSON.parse(raw.toString("utf8"));
    if (event !== "message.received" || data.isGroup) return;
    if (handled.has(data.messageId)) return; // retried delivery
    handled.add(data.messageId);
    if (greeted.has(data.from)) return; // one automatic reply per person
    greeted.add(data.from);

    try {
      await cm.messages.send({
        fromPhoneId: data.to,
        to: data.from,
        content: "Thanks for your message. We will get back to you shortly.",
      });
    } catch (err) {
      console.error("Reply failed:", err);
    }
  }
);

app.listen(3000, () => console.log("Listening on http://localhost:3000"));

Swap the fixed reply for a call to your AI model, an FAQ lookup or a database query. For a deeper walkthrough, see how to receive and process WhatsApp messages via webhook.

Common integration patterns

Pattern 1: Notification-only (one-way)

The simplest pattern. Your app sends WhatsApp messages when something happens: an order ships, an appointment is confirmed, an alert fires. No incoming message handling needed.

import os

import requests

CHATMAID_KEY = os.environ["CHATMAID_API_KEY"]  # sk_test_... or sk_live_...
SENDER = "+15551234567"  # a number added in your dashboard


def notify(phone: str, message: str) -> dict:
    response = requests.post(
        "https://developers-api.chatmaid.net/v1/messages/send",
        headers={"Authorization": f"Bearer {CHATMAID_KEY}"},
        json={"fromPhoneId": SENDER, "to": phone, "content": message},
        timeout=30,
    )
    response.raise_for_status()
    return response.json()["data"]


if __name__ == "__main__":
    sent = notify("+15557654321", "Your order has shipped.")
    print(sent["id"], sent["status"])

The Python and Flask notifications guide builds this into a small web app.

Pattern 2: AI chatbot (two-way)

Your webhook endpoint receives incoming messages, passes them to an AI model and sends the answer back, as in the Express example above. This is the basis for customer service agents, booking bots and FAQ responders. The guide to connecting an AI agent to WhatsApp builds this with Claude, ChatGPT or Gemini.

To let Claude Code, Claude Desktop, Cursor or Windsurf send and read WhatsApp messages directly, the Chatmaid MCP server runs with npx -y @chatmaid/mcp and adds 11 tools, including send_message, list_groups and list_inbound_messages.

Pattern 3: Human in the loop

Automated replies handle common questions, and your app decides when a person should take over. When someone types a reply in WhatsApp on the connected phone or another linked device, Chatmaid sends a message.outgoing webhook (if you subscribed to it), so your bot can pause itself for that conversation. Messages sent through the API raise message.sent instead. The n8n customer service agent uses this to hand a chat to a person.

Pattern 4: Alert and action loop

An agent watches a data source, such as server metrics, a sales pipeline or a support queue. It sends a WhatsApp alert when something needs attention and acts on the reply, for example "reply YES to restart the server". See WhatsApp ops alerts with an API.

Comparing your options

Sources: Meta pricing, Meta messaging limits, Twilio WhatsApp pricing, Twilio self sign-up, 360dialog pricing and 360dialog Embedded Signup, checked October 2026.

Chatmaid sits between the official providers and running a library yourself. It is quicker to start than the official route because there is no business review, and you do not maintain the connection. On cost, Twilio's own fee of $0.005 per message passes $7.99 at about 1,600 messages a month, counting replies you receive, before any Meta fees. What you give up is in the first column: an official Meta channel and the verified badge.

For the full numbers, see WhatsApp API pricing compared and Chatmaid vs Twilio.

Frequently asked questions

Can I use a WhatsApp API without registering a business?

Yes, with a linked-device API like Chatmaid Developers. You connect a regular WhatsApp number, so there is no Meta business portfolio, WhatsApp Business Account or business verification. Meta's Cloud API, and providers built on it such as Twilio and 360dialog, start from a business portfolio and a WhatsApp Business Account.

Does Meta's Cloud API require business verification?

Not to get started. As of October 2026, a new business portfolio can message 250 unique users outside the customer service window per moving 24 hours. Verifying your business is one way to lift that cap to 2,000. Twilio requires Meta verification before you move to production.

Can I use my personal WhatsApp number?

Yes. Linking adds Chatmaid as a device, and you stay logged in on your phone, so messages appear in both places. Many teams use a separate number for production so customer chats do not mix with personal ones, but it is not required.

Is there a free WhatsApp API for testing?

The Chatmaid sandbox is free, needs no credit card, and its test keys do not expire. Sends are simulated and message.sent webhooks are delivered for real. Sending real WhatsApp messages needs a live key, which costs $7.99/month flat for one number.

Will WhatsApp ban my number?

Very unlikely with normal use. Restrictions follow spam-like behavior, such as unsolicited bulk messages to people who do not have you saved, so only message people who expect to hear from you. If a number is ever restricted, link another one: your API keys, webhooks and message history stay on your account.

Can I send messages to WhatsApp groups?

Yes. GET /v1/groups with your sender's fromPhoneId lists the groups that number can post in. Pass a group's ID as to in POST /v1/messages/send. Inbound group messages carry the same ID in groupId, so you can reply straight from a webhook.