Connect your store to WhatsApp

Queue messages through your own Wassender device. Integrations requires Unlimited, a connected WhatsApp Web tab and the Integrations sending toggle enabled. Messages use campaign pacing, quota reservations, opt-outs, sending hours and daily limits. This feature does not guarantee delivery or immunity from WhatsApp restrictions.

1. Create a key

Open Integrations in the extension and choose New key. Copy the key immediately; it is displayed once. Keep keys on your server, never in browser code or public repositories. Revoke a compromised key in the extension.

Base URL: https://api.wassender.genoun.com/api/v1/public

2. Queue a message

curl -X POST https://api.wassender.genoun.com/api/v1/public/messages \
  -H 'Authorization: Bearer wsk_live_YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: order-1042-shipped' \
  -d '{"to":"15551234567","text":"Hi! Your order shipped.","tag":"order_update"}'

to is an international phone number with 7–15 digits; text is required, up to 4,096 characters. Optional tag labels your event. Optional sendAfter is an ISO date. The message body is sent literally. Use the same Idempotency-Key when retrying a request; keys are scoped to the account and limited to 128 characters.

{"success":true,"data":{"id":42,"to":"15551234567","status":"queued","tag":"order_update"},"idempotentReplay":false}

A new message returns HTTP 201. Replaying an idempotency key returns HTTP 200 with the original message. HTTP 401 means an invalid or revoked key; 403 means account or plan access is unavailable; 429 means rate limiting or quota exhaustion. The public API limit is 60 requests per key per minute.

3. Check delivery

curl https://api.wassender.genoun.com/api/v1/public/messages/42 \
  -H 'Authorization: Bearer wsk_live_YOUR_KEY'

Status	Meaning
queued	Waiting for the connected device and sending window.
claimed	Assigned to a device. It may be waiting for safe sending conditions.
sent	WhatsApp accepted the send; this is not a read receipt.
failed	Delivery failed or was uncertain. Inspect error before considering another send.
skipped	Recipient opted out or was not on WhatsApp.
expired	Not completed within 48 hours. Claimed messages are never automatically requeued: their delivery may be uncertain.

Google Sheets import

In Integrations, paste a Google Sheets URL whose sharing setting permits anyone with the link to read it. Select Read sheet, choose the phone column and use the rows in an editable campaign. Re-read the sheet to refresh it. This is a manual import; it does not write delivery results back to Sheets. Do not publish a private contact sheet unless you intend to make it public.

Signed webhooks

Save a public HTTPS URL in the extension. Local/private addresses, embedded credentials and nonstandard ports are rejected. Redirects are not followed. Copy the signing secret when the URL is first saved; rotate it if compromised and update your receiver.

Events: message.sent, message.failed, message.reply. Reply events carry attribution and reply time without the reply text. Event bodies contain event, data and sentAt. Failed delivery attempts retry after 5 seconds and then 30 seconds, for three attempts total. Make your receiver idempotent using event name and message ID.

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(secret, rawBody, header) {
  const supplied = String(header || '').replace(/^sha256=/, '');
  if (!/^[a-f0-9]{64}$/i.test(supplied)) return false;
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  return timingSafeEqual(Buffer.from(supplied.toLowerCase()), Buffer.from(expected));
}
// Check X-Wassender-Signature against the exact raw request bytes.
// Reject stale sentAt values according to your replay tolerance.

Privacy and operations

API message text is stored on the server because your device must retrieve it for delivery. Terminal message text and variables are erased after 48 hours on the next outbox sweep. Metadata remains for status and reporting. Reply text stays on the device. Disable Integrations to pause new API sends; an already dispatched message may still finish.

Messages sent via the API also appear in campaign reports. If a device disconnects during a send, inspect the campaign checkpoint and message status before retrying. Resume a paused integration run from the campaign view.

ربط متجرك بواتساب

تحتاج ميزة الربط إلى خطة Unlimited وتبويب واتساب متصل وتفعيل الإرسال في قسم Integrations. تمر الرسائل عبر نفس محرّك الحملات الذي يطبّق فترات الانتظار وحجز الحصة وقائمة إلغاء الاشتراك وأوقات الإرسال والحد اليومي.

أنشئ مفتاح API وانسخه فوراً واحفظه على خادمك. أرسل طلب POST إلى المسار /public/messages مع رقم دولي في to ونص في text. استخدم مفتاح Idempotency-Key نفسه عند إعادة الطلب لتجنّب التكرار. تابع الحالة بطلب GET إلى /public/messages/:id.

يمكن إعداد رابط HTTPS عام لاستقبال إشعارات الإرسال والفشل والرد. انسخ سر التوقيع عند إنشائه وتحقق من ترويسة X-Wassender-Signature باستخدام HMAC-SHA256 على بايتات الطلب الأصلية. إشعارات الرد لا تتضمن نصه.

يُحفظ نص رسالة API على الخادم لتوصيلها، ويُمسح بعد ٤٨ ساعة من انتهائها عند تشغيل التنظيف التالي. الرسائل المسندة لجهاز لا تُعاد تلقائياً إلى الطابور عند انتهاء المهلة، لأن وصولها قد يكون غير مؤكد. راجع التقرير قبل محاولة إرسالها مجدداً.

Back to Wassender