Developer guide

1. 1Developers → API keys → Create key. Name it after the system that will use it.
2. 2Copy the secret immediately — only a hash is stored, so it cannot be shown again.
3. 3Send it as a Bearer token on every request.
4. 4Revoke a key at any time; revocation takes effect on the next request.

curl -X POST https://wappr.lovable.app/api/public/v1/messages \
  -H "Authorization: Bearer $WAPPR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+919876543210",
    "template": "order_shipped",
    "language": "en",
    "variables": { "1": "Navin", "2": "TRK12345" }
  }'

• All phone numbers are E.164. Requests are rejected if the number cannot be normalised.
• Outside the 24-hour window only approved templates are accepted.
• Sends count against your plan quota and the number's daily Meta tier.
• Send an Idempotency-Key header to make retries safe.
• Rate limited per key; 429 responses include a Retry-After header.

Register endpoint URLs under Developers → Webhooks and subscribe to the events you care about: message.received, message.status, conversation.assigned, template.approved, campaign.completed, order.created.

• Every delivery is signed with HMAC-SHA256 over the raw body in the X-Wappr-Signature header.
• Compare signatures in constant time and reject anything that does not match.
• Non-2xx responses are retried with exponential backoff, then dead-lettered.
• Recent deliveries and their responses are visible for debugging.

const expected = crypto
  .createHmac("sha256", process.env.WAPPR_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");

if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
  return new Response("Invalid signature", { status: 401 });
}

Each workspace gets its own Meta callback URL, registered automatically during connection. It handles the verify handshake, validates Meta's signature, and turns payloads into inbound messages, delivery receipts and template status updates. You never need to configure it by hand unless you connected credentials manually.

• Chrome/Edge extension that puts the Wappr inbox in a side panel next to your CRM.
• Detects a phone number on the page and opens the matching conversation.
• Send quick replies and approved templates without leaving the CRM tab.
• Download the packaged build from the Developers page and load it, or install from the store listing.