WhatsApp Business API Integration for Indian Businesses

curl -X POST "https://graph.facebook.com/v23.0/$WA_PHONE_ID/messages" \
  -H "Authorization: Bearer $WA_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product": "whatsapp",
    "to": "919876543210",
    "type": "template",
    "template": { "name": "hello_world", "language": { "code": "en_US" } }
  }'

function sendWhatsApp(string $to, string $templateName, array $components = []): array {
    $url = 'https://graph.facebook.com/v23.0/' . getenv('WA_PHONE_ID') . '/messages';
    $body = [
        'messaging_product' => 'whatsapp',
        'to'       => $to,
        'type'     => 'template',
        'template' => [
            'name'       => $templateName,
            'language'   => ['code' => 'en'],   // must match the template's language
            'components' => $components,
        ],
    ];
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => json_encode($body),
        CURLOPT_HTTPHEADER     => [
            'Authorization: Bearer ' . getenv('WA_ACCESS_TOKEN'),
            'Content-Type: application/json',
        ],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 15,
    ]);
    $response = curl_exec($ch);
    if ($response === false) {
        throw new RuntimeException('WhatsApp API error: ' . curl_error($ch));
    }
    return json_decode($response, true);
}

// Order confirmation
sendWhatsApp('919876543210', 'order_confirmation', [[
    'type' => 'body',
    'parameters' => [
        ['type' => 'text', 'text' => 'Rajesh'],     // {{1}}
        ['type' => 'text', 'text' => 'ORD-1234'],   // {{2}}
        ['type' => 'text', 'text' => '₹1,500'],     // {{3}}
    ],
]]);

async function sendWhatsApp(to, template, components = []) {
  const resp = await fetch(
    `https://graph.facebook.com/v23.0/${process.env.WA_PHONE_ID}/messages`,
    {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${process.env.WA_ACCESS_TOKEN}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        messaging_product: 'whatsapp',
        to,
        type: 'template',
        template: { name: template, language: { code: 'en' }, components },
      }),
    }
  );
  if (!resp.ok) throw new Error(`WhatsApp API ${resp.status}: ${await resp.text()}`);
  return resp.json();
}

import express from 'express';
import crypto from 'node:crypto';

const app = express();

// Verification (GET): Meta checks the endpoint when you register it
app.get('/webhook/whatsapp', (req, res) => {
  if (req.query['hub.mode'] === 'subscribe' &&
      req.query['hub.verify_token'] === process.env.WA_VERIFY_TOKEN) {
    return res.send(req.query['hub.challenge']);
  }
  res.sendStatus(403);
});

// Events (POST): keep the raw body to check the signature
app.post('/webhook/whatsapp', express.raw({ type: 'application/json' }), async (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.WA_APP_SECRET)
    .update(req.body)
    .digest('hex');
  const got = req.get('X-Hub-Signature-256') || '';
  if (got.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected))) {
    return res.sendStatus(401);
  }

  res.sendStatus(200);          // answer quickly; Meta retries slow or failed deliveries

  const value = JSON.parse(req.body).entry?.[0]?.changes?.[0]?.value;
  for (const msg of value?.messages ?? []) {
    await handleIncomingMessage(msg.from, msg.text?.body);   // auto-reply, create ticket, etc.
  }
  for (const s of value?.statuses ?? []) {
    await updateDeliveryStatus(s.id, s.status);              // sent, delivered, read, failed
  }
});

{
  "messaging_product": "whatsapp",
  "to": "919876543210",
  "type": "interactive",
  "interactive": {
    "type": "button",
    "body": { "text": "Did your package arrive?" },
    "action": {
      "buttons": [
        { "type": "reply", "reply": { "id": "yes", "title": "Yes" } },
        { "type": "reply", "reply": { "id": "no", "title": "No, issues" } }
      ]
    }
  }
}

$otp = random_int(100000, 999999);

// Store only a hash, with an expiry, in your database
$stmt = $pdo->prepare('REPLACE INTO otp_codes (phone, code_hash, expires_at) VALUES (?, ?, NOW() + INTERVAL 10 MINUTE)');
$stmt->execute([$phone, password_hash((string) $otp, PASSWORD_DEFAULT)]);

sendWhatsApp($phone, 'otp_login', [
    ['type' => 'body', 'parameters' => [['type' => 'text', 'text' => (string) $otp]]],
    ['type' => 'button', 'sub_type' => 'url', 'index' => '0',
     'parameters' => [['type' => 'text', 'text' => (string) $otp]]],
]);