WABA Integration

Overview

This describes the server-side WABA integration model that Dualhook performs. Customers do not receive Dualhook's Meta authorization token and should use the dashboard for management operations.

Required Inputs

• BUSINESS_ID — from your Meta Business Portfolio
• WABA_ID — from your WhatsApp Business Account
• PHONE_NUMBER_ID — from your phone number
• Dualhook's reviewed Meta app and encrypted customer-scoped BISU token
• Webhook URL + verify token

Integration Flow

1. Validate token and permissions.
2. Discover WABA and phone number IDs.
3. Subscribe app and configure Webhook Override.
4. Send a test message.
5. Verify webhook delivery and statuses.

Validate Access Token

Dualhook validates the encrypted token server-side and exposes only the resulting permission and lifecycle status in the connection Health tab. The token itself is never returned.

List WABAs for a Business

Dualhook discovers the WABAs granted during Embedded Signup and presents them in the connection selection UI if Meta returns more than one candidate.

{
  "data": [
    { "id": "102290129340398", "name": "Acme Primary WABA" }
  ]
}

List Phone Numbers

Dualhook lists the phone numbers under each granted WABA server-side and presents the candidates without exposing Meta credentials.

{
  "data": [
    {
      "id": "123456789012345",
      "display_phone_number": "15550001234",
      "verified_name": "Acme Inc",
      "name_status": "APPROVED",
      "quality_rating": "GREEN"
    }
  ]
}

Subscribe and Configure Override

Dualhook performs the /{WABA_ID}/subscribed_apps call server-side with the encrypted BISU token and the callback URL and verify token configured in the dashboard.

{
  "success": true
}

Validation Checklist

• Token is valid and has required scopes.
• Correct WABA_ID and PHONE_NUMBER_ID are selected.
• subscribed_apps returns success.
• Incoming message webhooks arrive at your endpoint.
• Outbound status updates are received for test sends.

Dualhook sets and maintains webhook override configuration automatically. Message traffic remains Meta → your endpoint directly.