WhatsApp API for developers: send with REST, receive events by webhook, a scoped key — without talking to Meta

The four doors open today — and what is not

1. Order intake from any system

For stores not on Shopify or WooCommerce: your system posts the order event to an intake URL tied to your account, and the pre-shipping confirmation and status updates run as they do for connected stores. The URL and key come from the order-confirmation settings page, and the exact field shape is in the API Reference tab inside the dashboard.

POST https://app.arabybot.com/wa_notify_webhook/api/{api_key}
Content-Type: application/json

{ "order_id": "1042", "status": "created",
  "customer": { "name": "…", "phone": "+2010…" },
  "items": [ { "name": "…", "qty": 1, "price": 350 } ],
  "total": 350, "currency": "EGP" }

The exact field names and when each event is sent (created, confirmed, shipped, delivered, cancelled) are in the reference inside the dashboard — not copied here so they never go stale.

2. Cart events

A "cart created" and "cart abandoned" event from your store runs the recovery messages at the timing you set. Two ways: a URL with a secret and an HMAC signature for platforms we ship a plugin for, or a keyed URL for your own system. Cart recovery.

3. The OTP API

Three endpoints: send the code, verify it, resend it — with a public key and a secret for your app from the OTP page. The code arrives on an approved authentication template at Meta's rate for the recipient's country, cheaper than SMS in most of our markets. OTP on WhatsApp or SMS.

POST https://app.arabybot.com/wa_otp_api/send     { "phone": "+9665…", "app_key": "…", "secret": "…" }
POST https://app.arabybot.com/wa_otp_api/verify   { "phone": "+9665…", "code": "482913", … }
POST https://app.arabybot.com/wa_otp_api/resend   { "phone": "+9665…", … }

4. The agent reads your system: webhook tools and MCP servers

1. Define the tool

   From the agent → tools → add: the name ("order_status"), the description the model reads ("returns an order's status by number"), a public URL, the method GET or POST. The description decides when the agent calls it, so write it as you would explain it to a teammate.

2. Return simple JSON

   Clearly named fields with text values: {"status":"shipped","eta":"Thursday"}. The agent phrases the reply from them; return no HTML and no pages.

3. Or connect an MCP server

   From the agent → MCP servers → quick connect: the URL, the token and headers. The server's tool list is read and you choose which are allowed; tokens are stored encrypted.

4. Know the limits

   Public URLs only (no 10.x, no localhost), resolved once and pinned to one IP, redirects not followed, http/https only, and a per-customer call rate limit. That protects your system and ours alike.

Frequently asked questions