Skip to content
Wiz Message
API Management

Your website, CRM or order system sends WhatsApp from your own number

Create a key, choose exactly what it may do, map your templates once, and test every endpoint in a playground before you write production code. Requests are signed rather than authorised by a bare token, each key carries its own permissions and usage counter, and the webhook has a test button and a delivery log — so an integration failure is something you can see rather than something you suspect.

Included inWiz BotWiz CampaignWiz Pro

See plansView Pricing
A key plus a signature and timestamp — not a single bearer token that leaks forever
Signed requests
Its own permissions, its own usage counter, rotate the secret or revoke it outright
Per-key control
A playground and a webhook test button, before any of it reaches production
Test first

Who it's for

The business with a developer, or the agency wiring WhatsApp into a client's existing stack without wanting a two-week project.

The worry it answers

"Integrations mean a two-week developer project." A wizard creates the key and its template mapping, the playground proves it works, and the snippet generator hands over code that already runs.

How to integrate

  1. Run the setup wizard

    It creates the key and its first template mapping together, so you are not stitching two half-configured things by hand.

  2. Choose the permissions

    A key must carry at least one — a key with none cannot send anything, and the interface says so rather than failing silently later.

  3. Point the webhook somewhere

    Set your endpoint, press test, and read the delivery log to confirm what arrived.

  4. Try it, then take the snippet

    Call the endpoints in the playground, then generate a working code snippet for the template you configured.

Keys built to be operated, not just issued

Most competitors give you one global key and a PDF. Here each key is a managed object with a life cycle.

  • Granular permissions per key, with at least one required
  • Rotate a key's secret without destroying the key
  • Disable a key temporarily, or revoke it outright
  • Per-key usage: calls today, last used, total calls, and how many keys are active
  • Map a template to a key once, so the calls that use it stay short
  • A setup wizard that creates the key and its template mapping in one step

Prove it works before you ship it

Two features exist purely to shorten the loop between writing an integration and trusting it. The playground calls the real endpoints from the dashboard, so you can see the response shape before you write a line of code. The webhook has a test button and a delivery log, so when replies or delivery events do not arrive you can tell whether the problem is us, the network, or your endpoint — instead of guessing.

What you can send

Text, media, templates, a simplified template send for the common case, interactive lists, interactive buttons and reactions. Alongside those: look up a message's status, upload media, and download it again.

  • Text and media messages
  • Template messages, plus a simplified send for a template you have already mapped
  • Interactive lists and interactive buttons
  • Reactions
  • Message status lookup
  • Media upload and download

Good to know

Where this feature stops, in plain words — so nothing here surprises you after you buy.

  • The dashboard needs an active subscription. API calls additionally pass an entitlement check, with a short grace period after a lapse so an expiring card does not take your integration down the same hour.
  • Authentication is a key plus an HMAC signature and timestamp, not a plain bearer token. That is more work for the integrator, and it is deliberate — a leaked key alone is not enough to send on your behalf.
  • Requests are rate limited per key.
  • Free-form media needs an open 24-hour session with the recipient. Outside that window, use a template.
  • Reactions only work on messages from the last 30 days, and need WhatsApp's own message id rather than an internal one. Send an empty emoji to remove a reaction.
  • Template variables bind by name for named variables and by number for positional ones — not by the order they appear in the text. Renaming a named variable breaks sends that use it, and a header accepts at most one variable.
  • Rotating a secret invalidates existing signatures. Only revoking removes the key itself.

Included in

This feature is part of the plans below.

  • Wiz Bot
  • Wiz Campaign
  • Wiz Pro
Compare plans and pricing
FAQ

Frequently Asked Questions

How do I authenticate?

With an API key plus a signature over the request and a timestamp. It is a little more work than a bare bearer token, and that is the point: a key on its own is not enough for someone to send messages as you.

Can I test before writing code?

Yes. The playground calls the real endpoints from the dashboard, and the webhook has a test button with a delivery log.

What happens if my subscription lapses?

API calls carry an entitlement check with a short grace period, so a failed renewal does not silently break your production integration the same hour.

Can I give a key limited access?

Yes — permissions are per key, and a key must carry at least one. You can also rotate its secret, disable it temporarily, or revoke it.

How do I know how much a key is being used?

Each key shows calls today, when it was last used, and its total call count.

I already built against Meta's Cloud API. Do I have to rewrite?

No — see the Cloud API alternative feature. It mirrors Meta's own paths and request shapes, so existing code keeps working after a host and token change.

Wire WhatsApp into what you already run

Create a key, test it in the playground, and take the snippet.

See plans

Explore More Features

Discover other tools that make WizMessage the complete WhatsApp platform.