---
title: Official WhatsApp API: What It Is and How It Works (2026)
description: What the official WhatsApp API (Meta's Cloud API) is, why it exists, what it costs, who can use it, and how to connect your number without losing the app.
date: 2026-09-06
updated: 2026-09-16
category: api-oficial
tags: official whatsapp api, cloud api, whatsapp business, meta, tech provider
author: gabriel-miranda
cover: /blog-assets/covers/api-oficial-do-whatsapp.jpg
coverAlt: Smartphone next to a laptop on a work desk
coverSource: https://www.pexels.com/photo/29205845/
ptSlug: api-oficial-do-whatsapp
---

The official WhatsApp API is the WhatsApp Cloud API, Meta's own service that lets a system send and receive messages through a WhatsApp Business number. It is the only authorized way to automate WhatsApp, and that is why it comes with rules: a 24-hour window for free-form messages, Meta-approved messages outside it, and a sending limit that grows with the quality of the number. Any company can use it, with no contract with Meta, and since 2025 you can connect the number without taking it off the phone.

This article explains what the API is, what it allows, what Meta charges, who can use it, and how to connect a number in minutes.

## What is the official WhatsApp API, in a short answer

API stands for application programming interface. In practice, it is a door through which one piece of software talks to another. The official WhatsApp API is the door Meta opens so that a system, whether a support dashboard, a CRM, or an automation, can use a WhatsApp Business number programmatically: send a message, receive what the customer wrote, and know whether it was delivered and read.

The current technical name is WhatsApp Cloud API, because it runs on Meta's cloud. The commercial name is WhatsApp Business Platform. Both refer to the same thing. When someone says "WhatsApp Business API," "Cloud API," or "official API," they mean this service.

Three things the official API is not:

- **It is not an app.** Meta has no screen for operating the API. The screen comes from a provider, which connects the number and offers a dashboard, sending, and reports on top of the API.
- **It is not a chatbot.** The API delivers and receives messages. What to reply is decided by the system connected to it.
- **It is not the same as a tool that "reads" WhatsApp Web.** That difference is the subject of [official vs. unofficial API](/en/blog/official-vs-unofficial-whatsapp-api), and it decides whether your number still exists tomorrow.

## Why Meta created the API and what it prohibits outside of it

The WhatsApp Business app was built for one person to handle customers from a phone. When the business grows, needs appear that the app does not cover: a system that sends the order confirmation on its own, an appointment reminder to 300 patients, a team answering the same number from several computers, a record of every conversation inside the CRM.

Before the official API, the only way to do this was to automate WhatsApp from the outside, with programs that simulate a WhatsApp Web session or a phone. Meta treats that use as a violation. The WhatsApp Business Messaging Policy says, in short, that anyone using a service that violates the terms, such as sending unauthorized bulk messages, may have access to WhatsApp Business services restricted or removed. The messaging guidelines go the same way and prohibit unofficial clients, bulk sending, and automation that harms WhatsApp or its users. Detection is automatic and is fed by reports from the people who receive the messages.

The official API exists to give those needs a legitimate path. The trade is simple: the company gets automation, stability, and a number that does not get banned for "improper use"; in return, it accepts Meta's rules about when it may write to someone and what it may send.

### WhatsApp Business app vs. API: what changes in practice

| | WhatsApp Business app | Official API (Cloud API) |
|---|---|---|
| Who operates it | One person, from the phone or WhatsApp Web | A system, programmatically |
| Message to someone who has not written first | Free-form, with the risk of reports and a ban | Only with a Meta-approved message |
| Bulk messages | Broadcast list, with a cap and no guarantee | Campaign with an approved message, within the number's sending limit |
| Conversation history | Stays on the device | Reaches the system by webhook and lives wherever the company wants |
| Cost | Free | Meta charges per delivered template message; the provider charges for the software |
| Number on the phone | Yes | Depends: with coexistence, yes; with a new API-only number, no |
| Integration with CRM, store, calendar | No | Yes, by API and webhook |

The last row is the most confusing. Until 2025, using the API meant taking the number off the phone. Today there is coexistence, covered below, in which the number stays in the app and also answers through the API.

### On-Premises is gone: the Cloud API is the only official architecture

For years Meta offered two ways to use the API: the Cloud API, hosted by Meta, and the On-Premises API, in which the company or the provider ran its own WhatsApp server. According to Meta's changelog, On-Premises was shut down in October 2025. Since then, every official integration runs on the Cloud API.

For buyers, this simplifies the decision: every serious provider sits on top of the same Cloud API, and the difference between them is what they build on top of it.

## What you can do with the API

The API covers three uses, and it is worth understanding each one because Meta's rules change from one to the next.

### Customer support: the 24-hour window and free-form messages

When a customer writes to the number, Meta opens a 24-hour customer service window. Inside it the company can reply with anything: text, image, audio, document, buttons. Each new customer message restarts the countdown.

After 24 hours without a customer message, the window closes. From then on the company cannot send a free-form message; Meta rejects it with error 131047. To reopen the conversation you have to use a Meta-approved message, which the documentation calls a template. The details of how the window works, including the 72-hour window for people who arrive through an ad, are in [the 24-hour WhatsApp window](/en/blog/whatsapp-24-hour-window).

For support teams, the dashboard needs to show whether each conversation's window is open, otherwise the agent finds out from the error. In Frame Conexa, the conversation list flags the window and switches the sending mode on its own when it closes.

### Bulk sending with Meta-approved messages

Outside the window, the company can only start a conversation with a template. It is a message with fixed text and variables, submitted for Meta's approval before first use, in one of three categories: marketing, utility, and authentication. A promotion is marketing; an order confirmation and an appointment reminder are utility; a verification code is authentication. How to write a template that gets approved is covered in [approved WhatsApp templates](/en/blog/approved-whatsapp-template).

Official bulk sending is exactly that: a template campaign to a list of contacts who gave permission. Two Meta rules apply here, and neither belongs to the provider. The first is opt-in: you can only write to people who gave you their number and agreed to receive messages from the company. The second is the sending limit, which starts at 250 unique recipients per 24 hours and rises with quality. The article on [official WhatsApp bulk messaging](/en/blog/official-whatsapp-bulk-messaging) covers both in detail.

### Integration: webhooks, REST API, automations, and AI

The third front is integration with the rest of the business, and it uses two mechanisms. The REST API is the sending side: the system makes an HTTP request and the message goes out. The webhook is the receiving side: Meta calls a company URL every time a message arrives or the status of a sent message changes, and signs each call with the `X-Hub-Signature-256` header so the receiver can verify the origin.

A provider puts a layer on top of this. In Frame Conexa, sending is a call to the public API, authenticated by a token created in the dashboard:

```bash
curl -X POST https://frameconexa.com/api/v1/instances/$FRAME_CONEXA_INSTANCE_ID/messages \
  -H "Authorization: Bearer fc_SEU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"to":"5585999990000","type":"text","text":{"body":"Olá!"}}'
```

And incoming events arrive in an envelope of their own, with the `payload` exactly as Meta sent it, signed with `X-Frame-Signature-256`:

```json
{
  "type": "messages",
  "clientId": "8",
  "instanceId": "6ed76b84-4d65-4f3d-88c1-8d4174bdce73",
  "customerId": null,
  "customerRef": null,
  "payload": {}
}
```

It is the same mechanism that powers n8n, Make, and AI agents. The full guide, with signature validation and duplicate handling, is in [how to integrate the Cloud API with webhooks](/en/blog/whatsapp-cloud-api-webhook-integration) and in the [documentation](/docs/quickstart).

## What it costs: what Meta charges and what the provider charges

The bill has two parts, and they go to different places.

**Meta charges for API usage.** The company that owns the number pays, with a card registered in its own WhatsApp Business account inside Business Manager. The invoice comes from Meta, not from the provider.

**The provider charges for the software.** That means the dashboard, the connection, campaigns, reports, and the public API. Some providers also charge an extra per-message fee on top of Meta's rate. Frame Conexa does not: the subscription is per number, and each message costs what Meta charges, with no middleman. Plans are listed in [per-number pricing](/#precos).

### Price per delivered message, by category

Since July 1, 2025, Meta has charged per delivered template message. The previous model, which charged per 24-hour conversation, was discontinued. Only the three template categories are charged, and the rate depends on the category and on the country of the recipient's number, not the company's country.

| Message type | What Meta charges today |
|---|---|
| Message received from the customer | Never charged |
| Free-form message inside the 24-hour window | Free until 09/30/2026; charged from 10/01/2026 |
| Utility template inside an open window | Free until 09/30/2026; charged from 10/01/2026 |
| Utility template outside the window | Charged per delivered message |
| Authentication template | Charged per delivered message |
| Marketing template | Charged per delivered message, higher rate |
| Any message inside the 72-hour window opened by an ad | Free |

For Brazil, the rate card Meta published in September 2026 puts marketing at around 6 US cents per message and utility and authentication at 0.68 US cents, a figure Meta itself uses as an example on its page about the October changes. Check the official rate card before doing any math: Meta updates the table, and the amount in reais (R$, the Brazilian currency) depends on the account's billing currency. There is a volume discount only for utility and authentication, counted across the whole portfolio and reset every month; marketing has no volume discount.

The full table, with what changes in reais and how to estimate the cost of a campaign, is in [WhatsApp Business API pricing](/en/blog/whatsapp-business-api-pricing).

### October 1, 2026 change: service messages become billable

This is the change that most affects anyone using the API for customer support. Today a free-form reply inside the 24-hour window is free. According to the official pricing updates page, starting October 1, 2026, Meta will charge per message both for the service message, which is the free-form reply inside the window, and for the utility template sent inside the window. The rate follows the utility and authentication table for the recipient's country.

What does not change: receiving stays free, and the 72-hour window opened by a Click-to-WhatsApp ad still exempts delivery. The WhatsApp Business app on the phone is not affected either; the charge applies to the platform.

> **Warning:** several providers repeat that there will be a monthly allowance of free service messages per number before charging starts. Meta's official page does not mention any allowance. Treat that information as unconfirmed until the October rate card comes out.

## Who can use it: is it only for big companies?

No. The official API was born restricted to large brands, which needed a contract with a partner and approval from Meta. With the Cloud API and Embedded Signup, any company with a phone number and a Business Manager account can connect, and the process fits on one screen.

What Meta actually requires:

- **A phone number** that can receive an SMS or call for verification, or a number already in use in the WhatsApp Business app, in the case of coexistence.
- **A Meta Business Manager account**, which is free and becomes the portfolio that owns the number.
- **A card registered** in that account to pay Meta for messages. Without it, the number connects and replies inside the window, but cannot send templates.
- **Compliance with the messaging policy**, especially opt-in.

Business verification, with documents, is optional to get started. It only comes into play when the business wants to raise its sending limit beyond the initial tier, and it is the subject of [WhatsApp Business API messaging limits](/en/blog/whatsapp-business-api-messaging-limits).

It is also worth knowing the two kinds of provider Meta recognizes, because that changes who sends the invoice. A **Solution Partner** is a partner that bills the customer directly and can extend a credit line; when onboarding through one, the company does not register a card. A **Tech Provider** offers the software and has no credit line: the company registers payment in its own account and pays Meta directly, with no per-message markup. Frame Conexa is a Meta-verified Tech Provider, and for that reason it cannot register the card on the customer's behalf. That is a limit of the program, and the product handles it by handing over the Business Manager link when the account does not have payment set up yet.

## Coexistence: using the API without taking the number off the phone

Until 2025, connecting a number to the API required removing it from the app. The business lost the history on the device and the team lost the way of working they already knew. Many small companies gave up right there.

Coexistence solves this. The number stays in the phone app and also exists on the Cloud API. Whoever handles customers in the app keeps doing so; the system connected to the API sees the same conversations, sends campaigns, and receives every message by webhook. If the number's owner authorizes it, Meta sends the provider the last 180 days of history, in batches, and the dashboard is born with the old conversations already in it.

The official coexistence rules that matter to decision makers:

- The app must be version 2.24.17 or later.
- Sending through the API is fixed at 20 messages per second on that number.
- Some app features are turned off: disappearing messages, view once, live location, and creating new broadcast lists. Groups, calls, and catalog stay on the phone, but do not go through the API.
- The phone must stay active. A primary device inactive for about 14 days disconnects the integration.

It is Frame Conexa's default mode and the recommended path for anyone already handling customers in the app. The details of each limitation, and how to migrate without losing the number, are in [WhatsApp Business coexistence with the API](/en/blog/whatsapp-business-api-coexistence).

> **Note:** for a new number, with no app on a phone, there is the other mode: the number lives only on the Cloud API, without the 20-messages-per-second limit and without the app's feature restrictions. The choice is made in the first step of the connection.

## How to connect in minutes with Embedded Signup

Embedded Signup is Meta's own window that appears inside the provider's site. In it, the company logs in with Facebook, picks or creates the Business Manager portfolio and the WhatsApp Business account, enters the number, and authorizes the provider to operate it. At the end, Meta returns the number's identifiers and a code that can be exchanged for an access token, without which the provider can neither send nor receive anything.

What happens on the Frame Conexa side after the click:

1. The dashboard opens Embedded Signup in the chosen mode, coexistence or new number.
2. The company authorizes in Meta's window. In coexistence, the phone app asks for confirmation and, if authorized, for sharing the history.
3. The server exchanges the code for the token, checks the number's state, subscribes to the account's webhooks, and saves the instance. The token is stored encrypted and never appears in the dashboard.
4. In coexistence, the history and contacts syncs begin. For a new number, the server registers the number on the platform.

Whoever operates Embedded Signup must be a Meta-approved Solution Partner or Tech Provider, with App Review completed. That is what sits "on the other side of the window," and it is the subject of [WhatsApp Embedded Signup](/en/blog/whatsapp-embedded-signup). For someone who buys the slot but is not the person holding the phone, Frame Conexa generates a connection link: the end customer opens it, does only the Embedded Signup, and the number is created in the account of whoever bought it.

## Limits Meta imposes: capacity, quality, and opt-in

Every limit that shows up day to day in the API comes from Meta. It is worth repeating, because the natural suspicion of anyone paying is that the limit comes from the provider.

**Number capacity.** This is the number of unique recipients the company can start a conversation with outside the window, in a rolling 24-hour period. The official tiers are 250, 2,000, 10,000, 100,000, and unlimited. Since October 2025 the limit is calculated at the portfolio level and shared by all its numbers. To leave the first tier, the company verifies the business in Business Manager or delivers 2,000 out-of-window messages to 2,000 unique numbers within 30 days with good quality. The next step up is automatic: high quality on all numbers and use of at least half of the current limit in the last 7 days move you up one tier within 6 hours.

**Quality.** Each number has a rating, green, yellow, or red, calculated from user feedback over the last 7 days: blocks, reports, and stated reasons. An old version of the rule said that a red rating dropped the limit one tier after 7 days. According to the official page on messaging limit changes, that stopped applying in October 2025: the limit is no longer downgraded because of a quality drop. Quality still counts toward moving up a tier, toward spam restrictions, and toward template pausing, which Meta does automatically when templates reach low quality.

**Per-user limit.** Meta also limits how many marketing templates the same user receives, summed across all the companies that message them. When it kicks in, the API returns code 131049 and the guidance is to wait 24 hours. It is not a limit on your number, and insisting prolongs the block.

**Opt-in.** You only write to people who gave you their number and agreed to receive messages. Anyone who asks to stop must be honored, including when they ask outside WhatsApp. Error 131050 is Meta telling you the person turned off marketing from your company, and the contact has to come off the list.

A provider does not eliminate these limits, because it cannot. What it does is make them visible before the error: show the number's capacity before creating the campaign, pause sending when Meta flags spam, remove people who asked to leave, and translate each code into an action, as in [WhatsApp API errors](/en/blog/whatsapp-api-errors-131047-131026-131049).

## Frequently asked questions

### Is the official WhatsApp API free?

Meta does not charge for the API itself, and there is no monthly fee. It charges per delivered template message, in three categories, with the rate set by the recipient's country. Receiving messages costs nothing, and a free-form reply inside the 24-hour window is free until September 30, 2026. What you pay beyond that is the software from the provider that connects the number and offers the dashboard.

### Do I need to take the number off my phone to use the API?

Not anymore. With coexistence, the number stays in the WhatsApp Business app on the phone and also answers through the API, with the last 180 days of history imported if the owner authorizes it. The losses are specific: new broadcast lists, disappearing messages, view once, and live location stop working in the app, and sending through the API is capped at 20 messages per second. For a new number, you can connect it to the API only, with no app.

### What is the difference between WhatsApp Business and the official API?

WhatsApp Business is the app, built for one person to handle customers from a phone. The official API is Meta's service for a system to operate the number: send programmatically, receive by webhook, integrate with a CRM, and run campaigns of approved messages. The app is free and has no window rule; the API charges per template message and requires an approved message outside the 24-hour window. With coexistence, the two live together on the same number.

### Can a small business use the official API?

Yes. There is no minimum size, no contract with Meta, and no prior approval of the company. What is required is a number, a free Business Manager account, and a card registered in it to pay for messages. Business verification only comes into play when the business wants to raise its sending limit beyond the initial 250 recipients per 24 hours.

### What changes in billing in October 2026?

Starting October 1, 2026, Meta will charge per message for the free-form reply inside the 24-hour window and for the utility template sent inside it, both of which are free today. The rate follows the utility and authentication table for the recipient's country. Receiving stays free, the 72-hour window for people who arrive through an ad still exempts delivery, and the phone app is not affected.

## Next step

If the number already handles customers in the app, the shortest path is to connect it in coexistence and see the conversations in the dashboard the same day. The [per-number plans](/#precos) show what each type of number does; for anyone who will integrate, the [first message guide](/docs/quickstart) takes you from token to first send.