WhatsApp

Memcode uses the official WhatsApp Cloud API. It stays inert until your Meta business is verified, which is an account state Meta controls, not something the gateway can detect. Configure it now and switch it on once verification is complete.

Step 1: Set up the Cloud API

In the Meta for Developers console, create an app with the WhatsApp product. From the WhatsApp setup you get:

• a phone number id, a non-secret identifier for your sender number,
• an access token for the Graph API,
• an app secret, found under App settings > Basic.

Choose a verify token, any random string, which Meta echoes back during the webhook handshake.

Step 2: Add the webhook

Point the WhatsApp webhook at your gateway's public address plus /webhook/whatsapp, using the verify token you chose. The gateway serves webhooks on :8787 by default; expose it over HTTPS with a tunnel in local development. Inbound messages are signature-verified with the app secret, so the app secret is required before the channel will accept traffic.

Step 3: Configure

memcode gateway setup

Choose whatsapp, enter the phone number id, and paste the access token, verify token, and app secret. Add the phone numbers allowed to drive the agent. The tokens are written to your global .env; the phone number id and allow-list are written to gateway.yaml.

Step 4: Activate

Once your Meta business is verified, set the channel active in gateway.yaml:

channels:
  whatsapp:
    active: true

Then run:

memcode gateway

The signature verifies that a message really came from Meta; your allow_from list of phone numbers decides which senders may drive the agent.