Send WhatsApp messages with Go via REST API: full example

zapzap/client.go

package zapzap

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
	"time"
)

const base = "https://api.zapzapapi.com/api/v1"

type Client struct {
	HTTP     *http.Client
	Key      string
	Secret   string
	Instance string
}

func FromEnv() *Client {
	return &Client{
		HTTP:     &http.Client{Timeout: 30 * time.Second},
		Key:      os.Getenv("ZAPZAP_API_KEY"),
		Secret:   os.Getenv("ZAPZAP_API_SECRET"),
		Instance: os.Getenv("INSTANCE_ID"),
	}
}

// do executa a chamada, decodifica o JSON em out e devolve erro com o corpo se status >= 400.
func (c *Client) do(method, path string, in, out any) error {
	var body io.Reader
	if in != nil {
		b, err := json.Marshal(in)
		if err != nil {
			return err
		}
		body = bytes.NewReader(b)
	}
	req, err := http.NewRequest(method, base+path, body)
	if err != nil {
		return err
	}
	req.Header.Set("x-api-key", c.Key)
	req.Header.Set("x-api-secret", c.Secret)
	if in != nil {
		req.Header.Set("Content-Type", "application/json")
	}
	resp, err := c.HTTP.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	raw, _ := io.ReadAll(resp.Body)
	if resp.StatusCode >= 400 {
		return fmt.Errorf("zapzap %s %s: status %d: %s", method, path, resp.StatusCode, raw)
	}
	if out != nil {
		return json.Unmarshal(raw, out)
	}
	return nil
}

zapzap/send.go

package zapzap

// SendText envia uma mensagem de texto e devolve o messageId.
func (c *Client) SendText(number, text string) (string, error) {
	var out map[string]any
	err := c.do("POST", "/"+c.Instance+"/send/text", map[string]any{
		"number": number,
		"text":   text,
	}, &out)
	if err != nil {
		return "", err
	}
	id, _ := out["messageId"].(string)
	return id, nil
}

// SendMedia envia imagem, video, audio, documento etc. a partir de uma URL publica.
// mediaType: image, video, audio, ptt, document, sticker.
func (c *Client) SendMedia(number, mediaType, fileURL, caption string) (string, error) {
	var out map[string]any
	payload := map[string]any{
		"number": number,
		"type":   mediaType,
		"file":   fileURL,
	}
	if caption != "" {
		payload["text"] = caption
	}
	if err := c.do("POST", "/"+c.Instance+"/send/media", payload, &out); err != nil {
		return "", err
	}
	id, _ := out["messageId"].(string)
	return id, nil
}

main.go

package main

import (
	"fmt"
	"log"

	"example.com/app/zapzap"
)

func main() {
	c := zapzap.FromEnv()

	id, err := c.SendText("5511999999999", "Olá! Seu pedido saiu para entrega.")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println("texto enviado:", id)

	id, err = c.SendMedia("5511999999999", "document", "https://exemplo.com/nota.pdf", "Segue a sua nota fiscal.")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println("documento enviado:", id)
}

zapzap/check.go

package zapzap

// Existentes devolve apenas os numeros que estao no WhatsApp.
func (c *Client) Existentes(numbers []string) ([]string, error) {
	var out []map[string]any
	err := c.do("POST", "/"+c.Instance+"/chat/check", map[string]any{"numbers": numbers}, &out)
	if err != nil {
		return nil, err
	}
	var ok []string
	for _, item := range out {
		if in, _ := item["isInWhatsapp"].(bool); in {
			q, _ := item["query"].(string)
			ok = append(ok, q)
		}
	}
	return ok, nil
}

webhook.go

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"log"
	"math"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

func assinaturaValida(secret string, raw []byte, header string) bool {
	var t int64
	var v1 string
	for _, p := range strings.Split(header, ",") {
		kv := strings.SplitN(strings.TrimSpace(p), "=", 2)
		if len(kv) != 2 {
			continue
		}
		switch kv[0] {
		case "t":
			t, _ = strconv.ParseInt(kv[1], 10, 64)
		case "v1":
			v1 = kv[1]
		}
	}
	if t == 0 || v1 == "" || math.Abs(float64(time.Now().Unix()-t)) > 300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strconv.FormatInt(t, 10) + "."))
	mac.Write(raw)
	esperado := hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(esperado), []byte(v1))
}

func main() {
	secret := os.Getenv("ZAPZAP_WEBHOOK_SECRET")

	http.HandleFunc("/webhooks/zapzap", func(w http.ResponseWriter, r *http.Request) {
		raw, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 2<<20))
		if err != nil || !assinaturaValida(secret, raw, r.Header.Get("X-ZapZap-Signature")) {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		var evento map[string]any
		if json.Unmarshal(raw, &evento) != nil {
			w.WriteHeader(http.StatusBadRequest)
			return
		}
		w.WriteHeader(http.StatusOK) // confirma primeiro

		go func(id string, e map[string]any) { // processa depois
			data, _ := e["data"].(map[string]any)
			msg, _ := data["message"].(map[string]any)
			if fromMe, _ := msg["fromMe"].(bool); fromMe || msg == nil {
				return
			}
			log.Println("entrega", id, "mensagem de", msg["chatid"], ":", msg["text"])
		}(r.Header.Get("X-ZapZap-Id"), evento)
	})

	log.Fatal(http.ListenAndServe(":3000", nil))
}