Skip to content
WAQR comes included with Emboxia, Zygore and AXEN.See how

For developers

WhatsApp in your software with an API that explains itself

REST and JSON, Bearer authentication, idempotent sends, readable errors and signed webhooks. You write the integration; we run the connection infrastructure.

https://api.waqr.app/v1

Create account and API key See the API integration

  • Keys with scoped permissions

    Each API key has the permissions you choose and reaches only the connections you authorize. Shown once, rotatable and revocable.

  • Idempotency on every send

    POST requests that send messages require Idempotency-Key. If you retry, the message is not duplicated.

  • Errors you can understand

    application/problem+json responses (RFC 9457) with code, detail and X-Request-Id to trace any request.

  • Signed webhooks

    Every delivery is signed with HMAC-SHA256 and a timestamp. Retries with backoff if your server does not answer.

  • Visible limits

    RateLimit-* headers on every response and 429 with Retry-After when you hit your plan's limit.

  • Cursor pagination

    Stable listings with an opaque cursor, built to sync without losing or repeating records.

Send a message

One request. One message on its way.

You specify the connection, the recipient in E.164 format and the content. The response carries the message id and its initial status; the rest arrives by webhook.

Request 
curl -X POST https://api.waqr.app/v1/connections/conn_01J9ZQ4V8K/messages \
  -H "Authorization: Bearer wqk_live_xxx" \
  -H "Idempotency-Key: 6c4e2a8e-1f0b-4c7a-9b2e-0f1d2c3b4a5f" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+51987654321",
    "type": "text",
    "text": "Hola, tu pedido está listo."
  }'
Response 
{
  "id": "msg_01J9ZQ5C2M",
  "conversationId": "conv_01J9ZQ3T7A",
  "status": "pending",
  "createdAt": "2026-10-14T15:04:05Z"
}

Webhooks

Receive events in real time

Register an HTTPS endpoint from the dashboard and pick the events you want: received and sent messages, status changes, connection changes and revocations.

  1. 1 Recompute HMAC-SHA256 of "{t}.{raw body}" with your secret and compare in constant time.
  2. 2 Reject deliveries whose timestamp is older than 5 minutes.
  3. 3 Deduplicate with WAQR-Delivery or the event id: delivery is at-least-once.
Headers of a delivery 
POST https://tu-sistema.example/webhooks/waqr
Content-Type: application/json
WAQR-Event: message.received
WAQR-Delivery: dlv_0192a3b4c5d6
WAQR-Signature: t=1760454245,v1=5f2b9c…
Verification in Node.js 
import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyWaqrSignature(rawBody: string, header: string, secret: string) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

Resources

The essentials of API v1

  • GET /connections Connections your key can reach and their status.
  • POST /connections/{id}/messages Send text or files. Requires Idempotency-Key.
  • GET /conversations Conversations filtered by connection and status, cursor-paginated.
  • GET /conversations/{id}/messages History of a conversation.
  • GET /contacts Contacts with search by name or number.
  • GET /attachments/{id}/url Signed, time-limited URL to download a file.
  • POST /webhook-endpoints Register an endpoint and receive its signing secret.
  • GET /webhook-endpoints/{id}/deliveries Latest deliveries, responses and errors for your endpoint.

Full documentation, on its way

The OpenAPI-generated reference and step-by-step guides will be published with the beta. In the meantime, this page and the dashboard have what you need to send your first message; if you get stuck, write to us.

Talk to us

Your WhatsApp should not be isolated from your systems.

Connect it once and use it wherever you need it.

Start with WAQR

Using Emboxia, Zygore or AXEN? Connect it from your account