Webhooks

A webhook lets us call your server when something happens, so you do not have to keep asking. Webhooks are available on the Enterprise (Premium) plan.

Set it up

1. 1Open the Developer API page and go to the Webhook tab
2. 2Enter your HTTPS callback URL
3. 3Choose the events you want, then turn the webhook on
4. 4Press Save webhook, then Send test ping to check it works

Events

What we send

Each request is a POST with a JSON body in this envelope:

{
  "event": "webhook.test",
  "timestamp": "2026-11-03T09:30:00.000Z",
  "data": {
    "tenantId": "cmt8z1abc0000xyz",
    "message": "Test ping from your WhatsApp API"
  }
}

Verify the signature

When a signing secret exists, every request carries an X-Signature header: sha256= followed by an HMAC-SHA256 of the raw request body using your secret. Check it before trusting the request.

import crypto from "node:crypto";

function isFromWhatsAppApi(rawBody, header, secret) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header || "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}