Unofficial WhatsApp API: an honest guide (and when not to use it)

The official API is Meta's WhatsApp Business Platform: you register a number on the platform, go through business verification and use approved templates to start conversations. The unofficial one is a WhatsApp Web session running on a server, paired with your number by QR code, plus an API layer on top to send messages and receive events through a webhook.

Each connected number is an instance. You keep the number you already use, with its contacts and history, and write messages freely, with no template approval. If you want the terms in alphabetical order, open the WhatsApp API glossary.

ZapZap API is an unofficial API service. We make money when you pick this path, so read the rest with that in mind. To compensate, the guide includes what counts against our category and points out the cases where we do not sell the best solution.

If you would rather compare other unofficial tools, we have pages built on each project's official sources: WAHA, Baileys and Evolution API. For the side by side with the official one, see ZapZap vs the official API.

Number restriction is the main one. WhatsApp's Terms of Service, in the acceptable use section, prohibit accessing the services through unauthorized automated means and list bulk and automated messaging among the banned uses. That means any action WhatsApp takes on an account is within what the Terms provide for. No serious vendor can promise the number will never be restricted, and anyone who does is selling something they do not control.

Dependence on a protocol that is not yours. A WhatsApp Web session changes when WhatsApp changes, and keeping up with those changes is ongoing work for the vendor. There can be occasional instability, and there is no Meta service level agreement behind it.

Legal and reputation risk. Messaging people who did not ask to hear from you is a problem under both models, and data protection law applies equally. On the official platform part of that is blocked for you; on the unofficial one the responsibility is entirely yours.

The number as an asset. If your revenue depends on a single number, losing it hurts. Treating the number as irreplaceable is the costliest mistake in this model.

WhatsApp has no public rule with a magic number of messages per day, and anyone who says otherwise is repeating personal experience. What practice shows is that behavior weighs more than the tool: talk to people who already know you, avoid cold lists, vary the text, respect intervals and give an easy way out to anyone who does not want to receive messages.

Warming up the number before using it at volume helps its usage history look like a person's. The anti-ban practices and the guide on why WhatsApp bans numbers detail the triggers. All of this lowers the chance of a restriction. None of it brings it to zero.

Pick the official one when the number is the heart of the business and losing it would be unacceptable, when a contract, compliance or legal team requires an approved channel, when you send transactional notifications at large scale, or when the brand needs the official account badge.

The official API has clear rules: according to Meta's documentation, billing is per delivered template message since July 1, 2025, and outside the 24 hour window after the customer's last message you can only send an approved template. In return you get a channel backed by Meta itself. See the WhatsApp Business API guide for costs and paths.

It makes sense for validating a channel quickly, for conversational support and sales with your own contact base, for operations that live in groups, and for anyone who wants predictable cost per number and to start the same day with no business verification. It also makes sense as a test step before deciding whether to move to the official one.

Many businesses combine both: official for what needs the badge and scale, unofficial for everyday conversation. ZapZap charges R$15 per active number per month, prepaid, with no per-message fee; current values are on the pricing page.

Start with a secondary number, not the company's main one. Connect by QR code, talk first to customers who have already spoken with you, raise volume slowly and watch replies and reports. If anything looks odd, stop and slow down before pushing on.

On the technical side, the documentation shows a first send in a few minutes. If the test makes sense, scale calmly. If your risk analysis says your case needs the official API, it is better to know before investing in a flow.