WhatsApp Business API integration for SaaS, marketplaces, and clinics in 2026

In Pakistan, India, the UAE, Brazil, and most of Africa and Southeast Asia, WhatsApp is not a chat app — it is the default channel for business communication. A SaaS or marketplace launching in those markets without WhatsApp shipping in V1 is launching with one hand tied behind its back. The good news: Meta's WhatsApp Cloud API is fully production-ready in 2026, the pricing is predictable, and the integration path from Next.js or Node.js is short if you know which sharp edges to avoid.

What WhatsApp Business API actually unlocks

• Order confirmations, shipping updates, payment receipts, OTPs
• Appointment reminders and rescheduling for clinics, salons, services
• Two-way customer support with optional AI agent on top
• Re-engagement campaigns to opted-in users
• Marketplace match notifications — a job offer, a new listing, a chat from another user
• Cart abandonment, check-in reminders, renewal nudges

The 30-minute setup

1. Create a Meta Business Account at business.facebook.com
2. Add WhatsApp as a product, register a phone number (must be unused on the WhatsApp consumer app)
3. Generate a permanent System User access token — never use temporary tokens in production
4. Verify your business (BVID) so you can scale beyond the trial limits
5. Configure a webhook URL pointing at your Next.js / Node API route

Sending a message

// app/api/whatsapp/send/route.ts
import { NextResponse } from "next/server";

export async function POST(req: Request) {
  const { to, templateName, variables } = await req.json();

  const res = await fetch(
    `https://graph.facebook.com/v22.0/${process.env.WHATSAPP_PHONE_ID}/messages`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.WHATSAPP_TOKEN}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        messaging_product: "whatsapp",
        to,
        type: "template",
        template: {
          name: templateName,
          language: { code: "en" },
          components: [
            {
              type: "body",
              parameters: variables.map((v: string) => ({ type: "text", text: v })),
            },
          ],
        },
      }),
    },
  );

  const data = await res.json();
  if (!res.ok) return NextResponse.json({ error: data }, { status: 502 });
  return NextResponse.json({ id: data.messages[0].id });
}

Templates and the 24-hour rule

WhatsApp's most important rule: you can only send free-form messages to a user within 24 hours of their last message to you. Outside that window, you must use a pre-approved template. Templates are submitted in the WhatsApp Manager UI, take a few hours to a day to approve, and come in three categories — Marketing (most expensive), Utility, and Authentication.

Practical template strategy:

• Use Authentication templates for OTPs (cheapest, instant delivery)
• Use Utility templates for transactional events (order shipped, appointment confirmed)
• Use Marketing templates sparingly — they cost more and burn user trust if overused
• Plan templates upfront. Adding new templates mid-launch is a slow process you do not want on the critical path

Receiving messages (webhooks)

When a user replies, Meta posts to your webhook. Verify the signature, parse the payload, and dispatch to your application logic — typically a CRM update, an AI agent, or a human inbox.

// app/api/webhooks/whatsapp/route.ts
import crypto from "crypto";

export async function GET(req: Request) {
  const url = new URL(req.url);
  const mode = url.searchParams.get("hub.mode");
  const token = url.searchParams.get("hub.verify_token");
  const challenge = url.searchParams.get("hub.challenge");
  if (mode === "subscribe" && token === process.env.WHATSAPP_VERIFY_TOKEN) {
    return new Response(challenge);
  }
  return new Response("Forbidden", { status: 403 });
}

export async function POST(req: Request) {
  const body = await req.text();
  const sig = req.headers.get("x-hub-signature-256")!;
  const expected = "sha256=" + crypto
    .createHmac("sha256", process.env.WHATSAPP_APP_SECRET!)
    .update(body)
    .digest("hex");
  if (sig !== expected) return new Response("Bad signature", { status: 401 });

  const payload = JSON.parse(body);
  const messages = payload.entry?.[0]?.changes?.[0]?.value?.messages ?? [];
  for (const m of messages) {
    await handleIncomingMessage({
      from: m.from,
      text: m.text?.body,
      type: m.type,
      timestamp: m.timestamp,
    });
  }
  return new Response("OK");
}

Adding an AI layer

Once messages are flowing both ways, an AI agent on top is a few hundred lines of code. The pattern: every inbound message goes to your LLM with the conversation history, the LLM decides whether to reply directly or invoke a tool (book appointment, look up order status, escalate to human), and the result goes back through the WhatsApp send endpoint.

Always show 'AI assistant' branding inside the conversation, and make it trivial to type 'human' or a button to escalate. WhatsApp users are far more tolerant of AI than people give them credit for, as long as they can get to a person when they need to.

Costs

Meta charges per conversation, not per message. A conversation is a 24-hour window opened by either side. Pricing varies by country and category — in 2026, expect roughly:

• Service conversations (user-initiated) — typically free or near-zero
• Authentication (OTP) — $0.005 to $0.05 each, country-dependent
• Utility — $0.01 to $0.10
• Marketing — $0.03 to $0.20

Always monitor cost per opened conversation. The category Meta assigns to your template can shift, and a sloppily-written 'utility' template that gets reclassified as 'marketing' will silently 5x your bill.

The takeaway

WhatsApp Business API is no longer the awkward enterprise integration it was three years ago. The Cloud API path is short, the SDK ergonomics are clean, and the channel itself is where your users actually live in most of the world. The discipline is in templates, opt-ins, and the 24-hour rule — get those right and you have a delivery channel that consistently outperforms email and SMS on every metric we track.