Build with AI: how to set up clients' WhatsApp for an agency with Claude Code, OpenAPI and MCP

Four pieces. The llms.txt summarizes the product, price, limits and links for the agent. The OpenAPI specification and Postman collection describe the endpoints, in Portuguese, English and Spanish. The open-source MCP server (github.com/zapzapapi/zapzap-mcp) gives the agent ready-made tools, and the official SDKs (Node.js, Python and PHP, through the zapzapapi GitHub) cover integration in code. See the page on AI agents and the guide to the MCP server.

Put in the project's instructions file (CLAUDE.md, AGENTS.md or the Cursor rules) the links to the OpenAPI and llms.txt, the base URL and the names of the environment variables. Never paste the API key and secret into the prompt or the repository: the agent only needs to know that ZAPZAP_API_KEY and ZAPZAP_API_SECRET exist.

An instructions snippet that works: "The WhatsApp API is ZapZap. Specification: https://zapzapapi.com/openapi/zapzap-openapi.en.json. AI summary: https://zapzapapi.com/llms.txt. Base: https://api.zapzapapi.com/api/v1. Authentication: x-api-key and x-api-secret headers, read from ZAPZAP_API_KEY and ZAPZAP_API_SECRET. Use only endpoints present in the specification and say when a feature does not exist."

Prompts that work are small and verifiable. For a minimal CRM: "Create a Node.js script that receives ZapZap's incoming-message webhook and writes to a leads table (phone, name, first message, instance, date). Use only the fields the specification describes, validate the payload and respond 200 quickly." For a report: "Read the instances with GET /instances and, for each one, the campaigns with GET /{instanceId}/sender/listfolders. Generate a JSON with the counters log_total, log_delivered, log_read and log_failed." For reminders: "Schedule a message with POST /{instanceId}/sender/simple using scheduled_for in milliseconds."

Always ask for a test at the end: "write a test that runs against a staging instance". And tell the agent to cite which OpenAPI operation each call came from, which turns review into a one-minute job.

The snippet below is the base of almost everything: list the account's instances and check each one's status. It uses only documented operations, and works as a starting point for an internal dashboard of your clients' number health.

const BASE = "https://api.zapzapapi.com/api/v1";
const headers = {
  "x-api-key": process.env.ZAPZAP_API_KEY,
  "x-api-secret": process.env.ZAPZAP_API_SECRET,
};

const instances = await (await fetch(BASE + "/instances", { headers })).json();
for (const inst of instances) {
  const r = await fetch(BASE + "/" + inst.id + "/instance/status", { headers });
  console.log(inst.name, r.ok ? await r.json() : "HTTP " + r.status);
  await new Promise((res) => setTimeout(res, 1000));
}

Four high-return projects for an agency: a health dashboard for clients' numbers (which dropped, which need to reconnect), a minimal CRM fed by webhook, a monthly report per client (see automating reports) and a scheduler for follow-ups and reminders (see scheduling appointment messages). For the per-client ad lead flow, see tracking ad leads.

Start with the health dashboard: it is read-only, low risk and delivers value in the first week.

Review every send. An agent that generates code to send messages can, by mistake, send the same message to an entire list or ignore the pace. Require delays between sends, a volume cap per run and a test mode that writes to a log instead of sending. Do not approve code that sends to a list without consent, per the acceptable use policy.

Handle security too: key and secret only on the back end, never in the browser, and one key per environment. For the niche pages, see agencies with AI and resale under the client's brand.