Connecting WhatsApp through Meta, Twilio or Telnyx, and what has to be stored before a reply can go out.
WhatsApp is a two-way channel. Messages open tickets, and your replies go back to the customer. It is configured at Channels, WhatsApp, and connecting it needs admin.
Outbound is wired up
Stated plainly, because the answer used to be no. The adapter declares outbound support and implements sending: a reply loads the workspace's connection, loads the carrier's credentials, and hands the message to that carrier.
Two honest limits sit beside it:
- Readiness is per workspace. A connection that names a carrier but is missing one of the credentials or routing fields that carrier needs reads as not ready, and the composer stays closed rather than offering a send that would fail. The channel card says Two-way or Receive only accordingly.
- Attachments are not sent. A file uploaded onto a WhatsApp reply is accepted and not delivered. Uploading media to these carriers is a separate API call with its own permissions, and it is not wired. The reply goes, the file does not, and the ticket timeline records exactly that.
WhatsApp's own 24-hour session window still applies. Free-form text outside the window is refused by the carrier, and the refusal is recorded on the timeline rather than swallowed.
Choosing a carrier
A workspace reaches WhatsApp through exactly one of three carriers, and you pick which:
| Carrier | Notes |
|---|---|
| Meta Cloud API | Inbound webhooks are signature-verified, so the sender's WhatsApp id is Meta's assertion rather than the sender's claim. |
| Twilio | Inbound arrives as a form post. |
| Telnyx | Inbound arrives as a Telnyx webhook. |
The runtime is carrier-agnostic: the same adapter parses all three inbound shapes and dispatches every send to whichever provider the workspace configured.
After connecting, the page shows the non-secret routing facts an operator needs: the carrier, the business number, and the webhook address to point the carrier at. Credentials are stored in the secret store and are only ever reported as present or absent, never by value.
What a message becomes
Messages arrive as tickets with the channel WhatsApp. Inbound media that arrives as a reference rather than as a file, which is how the Meta Cloud API sends it, lands with the refusal recorded rather than as a link nobody can open.