How to send a WhatsApp message by API (Node.js, Python and PHP)

Four things: a ZapZap account, an instance (the WhatsApp number) connected by QR code in the dashboard, the API key and secret, and the instance ID. The key (x-api-key) and secret (x-api-secret) are in the dashboard under Settings and API, and the instance ID is shown in the instances list.

Every request carries the two authentication headers. There is no OAuth and no session: the authentication docs show the full format. The secret is for your server only. Never put it in code that runs in the browser or in the customer's app.

Before writing code, confirm everything works with a direct call. Replace the uppercase values with yours. The number goes with country code and digits only (55 for Brazil, then area code and number).

curl -X POST https://api.zapzapapi.com/api/v1/SEU_INSTANCE_ID/send/text \
  -H "Content-Type: application/json" \
  -H "x-api-key: SUA_API_KEY" \
  -H "x-api-secret: SEU_API_SECRET" \
  -d '{"number":"5511999999999","text":"Olá! Teste de envio pela API."}'

On Node.js 18 or later, fetch is built in, so there is nothing to install. Keep the credentials in environment variables.

const resposta = await fetch(
  `https://api.zapzapapi.com/api/v1/${process.env.ZAPZAP_INSTANCE_ID}/send/text`,
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": process.env.ZAPZAP_API_KEY,
      "x-api-secret": process.env.ZAPZAP_API_SECRET,
    },
    body: JSON.stringify({
      number: "5511999999999",
      text: "Olá! Seu pedido saiu para entrega.",
    }),
  },
);

if (!resposta.ok) {
  throw new Error(`Falha ${resposta.status}: ${await resposta.text()}`);
}
console.log(await resposta.json());

In Python, the requests library keeps it short. Always set a timeout so the call never hangs.

import os
import requests

url = f"https://api.zapzapapi.com/api/v1/{os.environ['ZAPZAP_INSTANCE_ID']}/send/text"
cabecalhos = {
    "Content-Type": "application/json",
    "x-api-key": os.environ["ZAPZAP_API_KEY"],
    "x-api-secret": os.environ["ZAPZAP_API_SECRET"],
}
corpo = {"number": "5511999999999", "text": "Olá! Sua consulta está confirmada."}

resposta = requests.post(url, json=corpo, headers=cabecalhos, timeout=30)
resposta.raise_for_status()
print(resposta.json())

In PHP, native cURL does the job with no extra library.

<?php
$url = "https://api.zapzapapi.com/api/v1/" . getenv("ZAPZAP_INSTANCE_ID") . "/send/text";

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "x-api-key: " . getenv("ZAPZAP_API_KEY"),
        "x-api-secret: " . getenv("ZAPZAP_API_SECRET"),
    ],
    CURLOPT_POSTFIELDS => json_encode([
        "number" => "5511999999999",
        "text" => "Olá! Seu boleto vence amanhã.",
    ]),
]);

$resposta = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($status >= 400) {
    throw new RuntimeException("Falha $status: $resposta");
}
echo $resposta;

Validate the number before sending: country code plus area code plus number, digits only. A malformed number is the most common error and the easiest to avoid. Handle the response: a 4xx status is almost always a problem with the request, so repeating it unchanged does not help, while a network failure or a 5xx can be retried a few times with increasing waits.

Keep the secret on the server and run the call in a queue or background task, not inside the user's click, so a slow send never freezes your screen. The API responds synchronously, and every send shows the typing indicator before delivering, with a duration proportional to the text length, which makes sending feel more natural.

Respect the pace. Sending many identical messages in a row to people who do not expect them is the pattern that leads to reports the most. No technique removes the risk of being blocked, but warming up the number, varying the text and sending only to people who agreed to receive reduces the chance. The anti-block guide covers each point.

Sending is half of the flow. To receive customer replies, set up a webhook and handle the events in your system, as the webhook docs show. If you use no-code tools, see the integrations with n8n, Make and others, which do the same send without code.