How to Build a WhatsApp AI Chatbot: Cloud API, Webhooks and the No-Code Path

A WhatsApp AI bot is assembled from three parts: the official WhatsApp Business Platform channel (Meta's Cloud API), a webhook that receives inbound messages, and a model that composes the reply. Sending a message takes a few lines of code; the real work is receiving messages, validating the webhook signature, handling templates and respecting the 24-hour window. If you have no developer, a ready-made platform covers the same three parts through interface setup.

Below are both routes step by step: what you need to create inside Meta, which values your code will need, and which mistakes eat the first day.

Two routes and how they differ

Both routes run through the same official channel. Automating over the regular WhatsApp app violates Meta's rules and the number can be banned, so "plug in an unofficial gateway" is not considered here.

What to set up before the first line of code

These are created once inside Meta and are required on either route:

• Meta Business Portfolio — the business account in Meta Business Suite that holds your assets. The portfolio is chosen when you connect the WABA and cannot be changed afterwards, so pick the one you intend to keep.
• A Facebook Page where you personally have admin rights.
• A phone number. Either a new one, or one already registered in the WhatsApp Business app.
• A payment method attached to Meta. Without it, outbound template messages will not send.

For the scenario where the number stays inside the WhatsApp Business app, two more requirements apply: the number must be active in the app with no Meta policy warnings, and the app must be on a current version. A brand-new number is better left to warm up for a week before connecting — fresh numbers pick up restrictions more often.

Step 1. The app, a test number and the sandbox

The WhatsApp Business Platform Developer Hub is where you create the app and open access to the Cloud API. Meta provides free test numbers, code samples, webhooks and a sandbox, so the first experiments need neither a purchased number nor a payment method.

A ready-made request collection is easiest to take from Meta's Postman workspace — the same Cloud API, without writing a client first.

Step 2. Phone Number ID and access token

In the app dashboard, under WhatsApp → Getting started, sit the two values everything else is built around.

The temporary token lives for hours and is good for exactly one "Hello world". For anything that has to run longer than an evening, use a system user token: otherwise the bot goes silent mid-day, and it will look like a broken webhook when it is really an expired token.

Step 3. The first outbound message

Next you send a single text request to the Cloud API endpoint with the sender number, the recipient number and the message body. The response should return a 200.

An important detail that costs people half a day: a 200 does not mean the message was delivered. It means the Cloud API accepted the request. If the customer received nothing, it is almost always the 24-hour window (below), not the code.

On SDKs: the official Node.js SDK for the Cloud API is archived. Its quickstart is still useful as a description of the environment variables and the minimal flow, but an archived package does not belong in new production code — work against the HTTP endpoints directly or through your own thin client.

Step 4. A webhook for inbound messages

Sending is half a bot. To receive messages you need a public HTTPS endpoint registered as a webhook in the app settings. Meta verifies the address when you connect it, then delivers events to it: inbound messages, delivery and read statuses, changes.

Two things to do immediately rather than "later":

1. Validate the signature of incoming requests. Otherwise your endpoint is open to anyone who learns the URL. Meta's own whatsapp-api-examples repository ships signature-validation-with-webhooks-payloads for exactly this, with a basic receiver in receive-webhook-js.
2. Answer the webhook fast and process asynchronously. Meta expects a quick response; move model generation into a queue, or you will get redeliveries and duplicate messages to the customer.

The same repository carries examples for templates (message-templates-js), media (media-messages-js) and interactive messages (interactive-messages-js) — faster than assembling request bodies from the documentation.

Step 5. Wire up the model

The "understand → clarify → answer" logic is a model call sitting between the webhook and the send. The OpenAI Responses API has everything needed:

• instructions — the system prompt: who the agent is, what it sells, what it must not promise;
• input — the customer's current message;
• tools — functions the model calls on its own: look up a price, check a slot, create a deal in the CRM;
• previous_response_id or conversation — multi-turn state, so the bot remembers earlier turns;
• structured output — for when you need fields rather than prose: name, city, budget, readiness to book.

The knowledge base is connected through a search tool over your documents. The rule that matters lives in the instructions, not in the code: whatever is not in the documents, the agent does not invent — it promises to check. Without that line, the bot will one day confidently quote a price that does not exist.

Step 6. Templates, categories and the 24-hour window

When the customer messages first, a 24-hour customer service window opens, and free-form replies are allowed inside it. Once it closes, the conversation can only be restarted with an approved template — described, for example, in 360dialog's documentation on free versus billed messaging.

Meta splits messages into categories, and the category drives both review and price:

The practical consequence for bot architecture: the agent must answer immediately, and the follow-up flow must already have approved templates. If you plan to chase customers a day later, submit templates for review before launch, not after. The mechanics of bulk sending are covered separately in how to run a WhatsApp broadcast.

The no-code path: what the platform does

A ready-made platform covers exactly the same steps: connection through Meta, webhooks, conversation storage, templates, the knowledge base and human handoff. What changes is not the outcome but who is on duty when a token expires.

In Pleep's WhatsApp integration the connection runs through Facebook login, after which the channel card shows the WABA ID and Phone Number ID — the same values you would otherwise fetch by hand. Before connecting, a wizard checks readiness: is there a Meta Business Portfolio, a Facebook Page with admin rights, a registered number, an attached payment method.

You pick one of two modes:

• WhatsApp on the phone. The number stays in the WhatsApp Business app, you do not delete anything, you keep replying from the phone, and the AI works in the same chats.
• WhatsApp and calls. A dedicated number fully under AI control: manual replies go through Pleep only, but this number can also be connected to voice calls.

The agent is configured through an ordinary conversation rather than a flow builder; leads go to amoCRM or Bitrix24, bookings to Google Calendar or Altegio, stock is checked in MoySklad, invoices go out through Kaspi Pay. The agent works in Russian and Kazakh. If the connection stalls on Meta's side, a free 30-minute setup call is available.

Pricing: Light is 42,380 KZT/month ($81.50) at 1,500 text messages with no voice; Business is 68,380 KZT ($131.50) at the same volume. The price is base plus usage, voice-agent minutes are billed separately at 50 KZT (or $0.12 when billed in USD), and Meta's message fees sit on top. The trial is 7 days. Current terms are on the pricing page, and the other channels and services on the integrations page.

A comparison of local and global platforms by price, Kazakh language support and official WABA is covered separately: the best WhatsApp chatbot in Kazakhstan.

Pre-launch checklist

1. Send a test message and wait for a 200 and actual delivery to the handset.
2. Message the bot from someone else's number and confirm the webhook received the event.
3. Replay a forged payload against your endpoint — signature validation should reject it.
4. Ask a question the knowledge base answers, and one it does not.
5. Let the 24-hour window close and confirm the follow-up goes out as a template, not free-form text.
6. Test human handoff: once an agent takes over, the bot must not keep replying in parallel.
7. Confirm the lead reached the CRM with the conversation context, not just the fact of contact.

What breaks most often

Frequently asked questions

Can I build a WhatsApp AI bot without the official API?

Such gateways technically exist, but automating over the regular WhatsApp app violates Meta's rules, and the risk falls on the number your customers already know. A production bot uses the WhatsApp Business Platform only.

How long does building it in-house take?

Sending the first message takes an evening. A working bot with webhooks, signature validation, a knowledge base, templates and CRM handoff takes weeks, and then it needs maintenance: tokens, API versions, template reviews.

Do I need a separate phone number?

Not necessarily. A number already registered in the WhatsApp Business app can be connected in a way that lets you keep replying from the phone. A dedicated number is needed when the same number should also place and take voice calls through the AI agent.

What is a Phone Number ID and how is it different from the number?

The number is what the customer sees. The Phone Number ID identifies that number inside the Cloud API and goes into your send requests. Both values live in the app dashboard and appear on the channel card after connecting.

Why do I get a 200 while the message is not delivered?

A 200 confirms the Cloud API accepted the request, not that the customer received the message. Most often the 24-hour window has already closed: free-form text cannot be sent at that point, an approved template is required.

Which model should I use for the bot?

Any current model with tool calling and structured output works for a knowledge-base dialogue. The practical difference usually comes from the instructions, the quality of the knowledge base, and what the bot does when there is no answer — not from the model.

Can I do this without a developer?

Yes, if the job is to answer, qualify and book. A ready-made platform takes on the Meta connection, webhooks, templates and CRM integrations. A developer is needed when the dialogue logic depends on an internal system that isn't among the ready integrations.