Webhooks explained: building two-way WhatsApp automation
Sending is half of messaging. The interesting half is what happens when the customer replies. WAGate pushes every reply, delivery receipt and connection change to your server as a webhook, and that opens up a lot.
The events
message.received— someone sent your number a message: sender, display name, type, text/caption, media link, whether it's a group, and the ID of any message they quoted.message.status— one of your sends moved to sent, delivered, read, played or failed.connection.update— the WhatsApp link connected, dropped or was logged out from the phone.call.received— an incoming voice/video call (and whether we auto-rejected it).
Trust, but verify
Every delivery carries X-WAGate-Signature: sha256=<hmac>, computed over the raw body with the secret from your dashboard. Verify it before you act on anything; it takes two lines and means nobody can forge “customer said yes” into your system.
Return a 2xx quickly — do slow work asynchronously. If your endpoint is down or returns an error we retry five times with growing gaps (30 s, 2 min, 8 min…), and you can see every attempt in the dashboard's delivery log.
Pattern 1: confirmations
Send “Reply YES to confirm your 10:00 appointment tomorrow.” When message.received arrives with body matching /^y(es)?$/i from that number, mark the booking confirmed and reply with a thank-you. Use reply_to with the message ID so your answer quotes theirs — it reads naturally in the chat.
Pattern 2: a tiny support bot
For the first-line FAQ you don't even need a server: Premium plans include auto-replies matched on keywords, prefixes or regex. “hours”, “price”, “where are you” get instant answers. Anything else falls through to a human — see pattern 3.
Pattern 3: human hand-off
Forward unmatched inbound messages into whatever your team already watches — a ticket system, a Slack/Discord channel, your forum's conversation system. When a staff member replies there, call POST /v1/messages with the customer's number. The customer sees a normal WhatsApp conversation; your team never leaves their tool.
Pattern 4: delivery intelligence
message.status tells you more than “sent”. If a critical message is delivered but not read after two hours, fall back to SMS or email. If it failed, the error says why — usually the number isn't on WhatsApp, which POST /v1/check would have told you up front.
Testing locally
Point the webhook at a tunnel (ngrok, Cloudflare Tunnel) during development, send yourself a message, and watch the payloads arrive. The dashboard log shows exactly what we sent and what your server answered.
Try WAGate free for 5 days
Link your WhatsApp number, get an API key and send your first message in minutes. No card required — pay with crypto when you're ready.
Start free trial See plans