WhatsApp

Connect your WhatsApp Business account to let the AI handle incoming messages automatically. When a customer messages your WhatsApp number, the bot replies in seconds.

Prerequisites

• A WhatsApp Business API account (via Meta Business Manager)
• A verified phone number connected to WhatsApp Business API
• A Meta App with the WhatsApp product added

WhatsApp Business API is different from the regular WhatsApp Business app. It requires a Meta Developer account and approval for a business phone number.

Connecting via Embedded Signup

The easiest way to connect is through Vlozi's built-in Embedded Signup flow:

1. Go to Chatbot → Channels → Add channel → WhatsApp
2. Click Connect with Meta
3. A Meta pop-up opens — log in and authorise Vlozi to access your WhatsApp Business Account
4. Select the phone number you want to connect
5. Vlozi exchanges the OAuth code for a long-lived access token and subscribes to webhook events

The phone number is now connected. Incoming messages are routed to your bot automatically.

How messages flow

Customer sends WhatsApp message
        │
        ▼
Meta delivers webhook to Vlozi (POST /chatbot/webhooks/whatsapp/{tenantId})
        │
        ▼
HMAC-SHA256 signature verified against X-Hub-Signature-256 header
        │
        ▼
Customer phone number resolved to CI contact (created if new)
        │
        ▼
Session found or created for this phone number
        │
        ▼
AI processes message → sends reply via WhatsApp API

Webhook security

Vlozi verifies every incoming WhatsApp webhook using HMAC-SHA256:

X-Hub-Signature-256: sha256=<hex signature>

The signature is computed from the raw request body using your Meta App Secret. If the signature doesn't match, the webhook is rejected with a 401.

Supported message types

Only incoming text messages trigger a bot response. Other message types are received and acknowledged but produce no reply.

Character limit

WhatsApp API messages are limited to 4,096 characters. The AI is instructed to keep responses concise (1–3 sentences), so this limit is rarely reached in practice. Very long responses are truncated to fit.

Multiple phone numbers

You can connect more than one WhatsApp number to the same bot configuration. All numbers share the same AI config, memory mode, and knowledge base. Sessions are separated per phone number per customer.

Credentials and security

WhatsApp access tokens are stored AES-256-GCM encrypted in the database. The encryption key is stored as a Cloudflare Worker secret and never written to disk or logs.

Disconnecting

In Chatbot → Channels → [channel] → Delete. Vlozi unsubscribes the webhook from the phone number before deleting the channel row. The phone number can be reconnected at any time.