WhatsApp API for Business: Official vs Open Source

The short answer

If you're messaging your own customers about orders, bookings and support, use Meta's official WhatsApp Business Platform, called the Cloud API, either directly or through a partner. It's the only route WhatsApp allows for business automation, and for a small business the bill is usually small: in Spain, each service reply past the first 1,000 per number a month costs $0.02 (€0.0166), checked October 22, 2026.

Open-source gateways such as WAHA, Evolution API and OpenWA, and the libraries under them (Baileys, whatsapp-web.js and whatsmeow), are free, and anyone comfortable running a server can have one going in minutes. But they connect as a linked WhatsApp Web device, which WhatsApp's terms don't allow for automated messaging, so the number can be banned. They're fine for alerts to your own team, prototypes and a spare number you can afford to lose. Don't put your main business number on one, and on either route, don't message people who never asked to hear from you.

How we checked

Our field note on OpenWA drew 288 Google impressions in the four weeks to October 19, 2026, from searches like "whatsapp api gateway" and "what is openwa". People are looking for a free way to connect WhatsApp to their other tools, and that note ended by telling them to compare it with the official route. This is that comparison.

On October 22, 2026 we read Meta's developer documentation on pricing, messaging limits and coexistence, the WhatsApp Business Messaging Policy, both versions of the WhatsApp Terms of Service and the rate calculator on whatsappbusiness.com. The same day we read each open-source project's repository, licence and documentation, and took star counts and release dates from GitHub. We haven't run a ban test, and nobody publishes ban rates, so the risk section below is what WhatsApp and the projects themselves say, plus dated user reports. Treat those reports as anecdotes.

AC0 sells consulting, not messaging software, and has no paid relationship with Meta, any Business Solution Provider or any project in this comparison.

The two routes

	Official Cloud API	Open-source gateway
How it connects	Meta's API, with a registered business number	A linked WhatsApp Web session, driven by a browser or by a reimplemented protocol
Allowed by WhatsApp	Yes, with opt-in and approved templates	Not for automated messaging
Cost	Per delivered message; 1,000 free service replies per number each month	Free software; you pay for the server
Who can set it up	A developer, or a partner that does it for you	Someone comfortable running a server
Setup	A Meta business portfolio, an approved display name and templates	A Docker container and a QR code scan
Your number	Can stay in the WhatsApp Business app at the same time (coexistence)	Uses an ordinary WhatsApp account
Biggest risk	Cost, template approval, a slow sign-up	The number gets restricted or banned

What the official API costs now

Meta has charged per delivered message since July 1, 2025. Most messages fall into one of four categories: marketing, utility (an order update or a booking reminder), authentication (a login code) and service (a free-form reply inside a conversation the customer started). Since July 1, 2026 there's a fifth: messages written by Meta Business Agent, Meta's own AI agent, which is billed by the token at about 4 to 5 US cents a message.

The change most pages haven't caught up with came on October 1, 2026. Meta started charging for service replies once a number has sent its first 1,000 in a month, and resumed charging for utility messages sent inside the 24-hour customer service window, which had been free since July 2025. Meta's own marketing page on whatsappbusiness.com still said service messages were free when we checked on October 22. The developer documentation is the one that matches the bill.

Rates per delivered message from Meta's calculator, checked October 22, 2026:

Category	Spain	US and Canada
Marketing	€0.0585 ($0.0707)	$0.025
Utility	€0.0166 ($0.02)	$0.0034
Service, past 1,000 a month	€0.0166 ($0.02)	$0.0034
Authentication	€0.0166 ($0.02)	$0.0034

Utility and authentication get cheaper at volume. In Spain, utility messages drop to $0.019 each above 100,000 a month.

To put that in a monthly figure: a business in Spain that sends 3,000 replies to customers a month and 500 booking reminders pays about $50 (€41.50) a month at October 2026 rates. That's 2,000 charged replies at $0.02, or $40, plus $10 for the reminders. In September the replies would have been free. A campaign is the expensive part: 1,000 promotional messages to customers in Spain cost $70.70 (€58.50). Without a payment method on file, Meta delivers the free 1,000 and then stops delivering service messages.

The rules that come with the API matter as much as the price:

1. The 24-hour window. You can send free-form messages only within 24 hours of the customer's last message. Outside it you need a template Meta has approved.
2. Opt-in. You need the person's permission before you message them first.
3. Messaging limits. A new business portfolio can start conversations with 250 people in any 24 hours. The limit rises to 2,000, 10,000, 100,000 and then disappears. Since October 2025 the limit is shared across every number in the portfolio, and verifying the business is one way to raise it.
4. Bots are allowed, with a way out. Automated replies are fine inside the window as long as there's a clear way to reach a person.
5. AI assistants are a special case. Since January 15, 2026, Meta's terms bar companies whose main product is a general-purpose AI assistant from the platform. That ban doesn't apply where the law requires Meta to give access, which includes the EEA from March 11, 2026. A business answering its own customers with AI isn't affected either way: Meta's pricing documentation says service messages can be written by a third-party AI or by people.

Getting started takes a Meta business portfolio, a WhatsApp Business account, a phone number and an approved display name. You can connect to the Cloud API yourself or through a Business Solution Provider, which sets it up and charges its own fees on top of Meta's message charges. Since October 23, 2025, businesses in the EU, the EEA and the UK can keep using the WhatsApp Business app on the same number while it's connected to the API. This "coexistence" goes through a partner and caps sending at 20 messages a second. Groups and calls stay in the app, broadcast lists are switched off, and disappearing messages, view-once and live location aren't supported. Messages you type in the app stay free.

Getting approved can be slow. Users report an onboarding loop that took weeks to clear and a display-name request denied after 15 days, and since April 9, 2025 Meta files a template submitted as utility under marketing when it judges the content promotional, which makes it cost more. That's why so many small businesses end up looking at the gateways.

Why the gateways put the number at risk

WhatsApp's terms rule this out in both versions. The terms for Europe, effective August 17, 2026, bar using the service "through automated or other means" and creating accounts "through unauthorized or automated means", and forbid building software or APIs that work substantially like WhatsApp and offering them to others without permission. The terms for the rest of the world name "bulk messaging, auto-messaging, auto-dialing" outright, and WhatsApp's Help Center has warned since 2019 that it may take legal action against bulk and automated messaging.

The projects don't hide this. Most say so in their own documentation:

• WAHA: "it is not guaranteed that you will not be blocked by using this method". Its guide on avoiding blocks says being reported as spam "a few times (5-10)" can get a number banned.
• whatsapp-web.js: "WhatsApp does not allow bots or unofficial clients on their platform".
• Baileys: the maintainers discourage "bulk or automated messaging usage".
• OpenWA: "There is always a non-zero risk of account restriction or ban." It tells users to pick a dedicated number they can afford to lose, and to use the Cloud API wherever compliance matters, such as healthcare, finance or large-scale commercial messaging, and for anything involving users in the EU.
• Evolution API: no ban warning in its README or documentation. That doesn't make it safer: in its default mode it connects the same way, through Baileys.

What users report fits that. In an r/n8n thread from September 12, 2026, one commenter described running six numbers for 14 months, three on each library and mostly answering inbound messages, with a single temporary restriction, on the Baileys side. Others in the thread weren't sure the library was what made the difference. On the Baileys tracker, issue 2850 (October 7, 2026) reports a 24-hour ban after about 60 messages sent in a loop and a second block after 9 more, and issue 2800 (September 5, 2026) a restriction after 30 to 40 messages to new contacts.

WAHA's guide to avoiding blocks reads like a description of what WhatsApp looks for. It says to reply rather than start conversations, let the customer write first through a wa.me link, wait 30 to 60 seconds between messages and vary the wording. If a use case needs that whole list to survive, it's the kind of messaging the official API's opt-in and templates exist for.

There's a second risk that has nothing to do with Meta. In December 2025, security researchers found lotusbail, a fake copy of Baileys on npm, the public registry developers install code from. It had more than 56,000 downloads and worked as advertised while sending messages, contacts and login sessions to an attacker. It also linked the attacker's device to the victim's account, and that device could stay linked after the package was uninstalled (The Register, December 22, 2025). A gateway reads every message on the number. Install it from the project's own repository, and check the Linked devices screen in WhatsApp on your phone now and then.

Six options compared

Checked October 22, 2026. Stars and releases from GitHub.

Option	What it is	Connects through	Licence	Cost	Activity	Best for
Meta Cloud API	Official API	Meta's servers	Meta's platform terms	Per message	-	Customer messaging you depend on
WAHA	HTTP API server in Docker	Browser (WEBJS, WPP) or protocol (NOWEB, GOWS)	Apache-2.0	Free; optional $5/mo support	7,658 stars; 2026.9.2 on Oct 2	One API with a choice of engines
Evolution API	HTTP API server for many tenants	Baileys, or Meta's Cloud API	Apache-2.0 plus branding conditions	Free	9,924 stars; last stable 2.3.7 in Dec 2025	Chatwoot and Typebot setups, with a path to the official API
OpenWA	HTTP gateway with a dashboard	whatsapp-web.js or Baileys	MIT	Free	16,120 stars; v0.25.0 on Oct 15	Trying it out with a visual dashboard
Baileys	TypeScript library	WhatsApp's protocol over WebSocket	MIT	Free	11,423 stars; 7.0.0 still a release candidate	Developers building their own gateway
whatsapp-web.js	Node.js library	WhatsApp Web in a headless browser	Apache-2.0	Free	22,782 stars; 1.34.7 in April 2026	Developers who want the real web client

Meta Cloud API: the default for customer messaging

The Cloud API is what WhatsApp expects a business to use, and since the On-Premises API stopped working on October 23, 2025, it's the only official API left for general messaging. It handles templates, the 24-hour window, read receipts and webhooks, and it doesn't care whether your number is new. The cost is per message and the setup takes days rather than minutes, sometimes weeks if Meta's verification stalls.

Choose it if: WhatsApp carries real customer conversations, you message people who opted in, or you want an AI assistant that answers customers.

Skip it if: you only need alerts inside your own team, or you're testing an idea you may throw away.

WAHA: one API, four engines, now fully free

WAHA puts one HTTP API in front of four ways of talking to WhatsApp. WEBJS and WPP drive a real Chromium or Chrome browser. NOWEB and GOWS speak WhatsApp's protocol directly, without a browser, so they run on a cheaper server. You can switch engine with small code changes, although responses and webhook payloads can differ between engines.

Since version 2026.6.1 in June, the paid Plus tier is gone. Unlimited sessions, media and every storage option are in the free Apache-2.0 Core, and the only payment left is an optional $5 a month to support the project. The GitHub project page still says multiple sessions need Plus, so trust the documentation over the project page. WAHA connects to n8n, Typebot, Chatwoot and MCP clients, and has client libraries for most languages.

Choose it if: you want the most mature self-hosted HTTP API and the freedom to change engine.

Skip it if: you need an official route. WAHA has no Cloud API engine.

Evolution API: the one with a door to the official API

Evolution API is the most popular choice in Spanish- and Portuguese-speaking automation communities, and the only gateway here that can also connect through Meta's official Cloud API. That makes it a good place to prototype on Baileys and move the same integration to the official route later. It's built for running many instances for many clients, needs a database and a few more server pieces to run, and plugs into Typebot, Chatwoot, OpenAI, Dify, Flowise and n8n.

Two things to check before you build on it. The licence is Apache-2.0 with two added conditions: keep its logo and copyright in frontend components, and show a usage notice in any project that uses it, closed-source systems included, or buy a commercial licence. And the project has slowed: the last stable release, 2.3.7, came out on December 5, 2025, with 2.4.0 still a release candidate in May 2026. The repository and documentation have also moved to the Evolution Foundation, and older tutorials link to documentation pages that no longer load.

Choose it if: you run Chatwoot or Typebot, serve several clients, or want a gateway that can switch to the official API.

Skip it if: you need a plain permissive licence for a product you sell, or a project with frequent stable releases.

OpenWA: the newest, with a dashboard

OpenWA, which we covered in May, is the youngest project here. The repository was created on February 2, 2026 and had 16,120 stars by October 22. It's MIT-licensed, runs either whatsapp-web.js or Baileys underneath, and adds a React dashboard, several sessions with API keys scoped to a session or a chat, Chatwoot and Typebot plugins, n8n nodes and a built-in MCP server. Its project page is the most direct about risk, and it rates the browser engine as safer than Baileys.

It hasn't reached version 1.0 yet; it was at 0.25.0 on October 15. Don't confuse it with open-wa/wa-automate, an older and separate project with its own licence and paid licence keys.

Choose it if: you want to see a gateway working, with a dashboard, before writing code.

Skip it if: you need a stable 1.0 API to build a product on.

Baileys and whatsapp-web.js: the engines underneath

Most gateways are built on one of these. whatsapp-web.js runs the real WhatsApp Web inside a headless browser, the same kind of tool we compared in our headless browser roundup. It's heavier, but it looks like the official client because it is the official client. Baileys reimplements WhatsApp's protocol over a WebSocket, so it's light and fast, and its version 7 is still a release candidate with breaking changes. For Go there's whatsmeow, MPL-2.0, which doesn't support calls or broadcast lists.

Use a library directly only if you're building your own gateway. Otherwise one of the three gateways above saves you from rebuilding sessions, webhooks and storage.

Which one to use, by job

Job	Use
A few people answering customers by hand	The WhatsApp Business app; no API needed
Order updates, booking reminders and support replies to customers	Cloud API, directly or through a partner
An AI assistant that answers your customers	Cloud API, with a handoff to a person
Keeping the WhatsApp Business app on your main number	Cloud API with coexistence, through a partner
Alerts to your own team from your own systems	A gateway on a spare number
A prototype before you commit	A gateway on a test number, or Evolution API so you can switch routes later
Messaging people who didn't opt in	Nothing. It breaks the rules on both routes

Hosted "unofficial APIs" carry the same risk, with a bill

Services such as Whapi.Cloud ($29 a month on its current offer, $40 list), Green API (from $12 a month per instance), UltraMsg ($39 a month, or $32.50 a month billed yearly) and WasenderAPI (from $6 a month per number) run the same kind of unofficial session for you, so you don't need a server. Prices were checked October 22, 2026. The ban risk doesn't change because someone else hosts it. UltraMsg says outright that bulk sending can get a number blocked, and Green API talks about reducing the risk, not removing it.

Wiring it into the rest of your tools

Whichever route you pick, the API is the easy part. The work is what happens around it: messages landing in a shared inbox like Chatwoot, a booking confirmation fired from your order system, a reply that updates the CRM, an AI draft a person approves before it goes out. That's where most WhatsApp projects stall, and it's the same problem whether the message arrives on WhatsApp, Telegram or Slack.

If you want WhatsApp follow-up connected to the tools your team already uses, that's the kind of workflow we build.

Sources

Checked on October 22, 2026: Meta's developer documentation on pricing, messaging limits, template categories and AI providers; the WhatsApp Business Messaging Policy; the Meta Terms for WhatsApp Business Platform; the WhatsApp Terms of Service for Europe and elsewhere; the WhatsApp Help Center notice on unauthorized use; the rate calculator on whatsappbusiness.com; the WAHA documentation including its guide to avoiding blocks, engines page and Plus page; the Evolution API licence; and the repositories of WAHA, Evolution API, OpenWA, Baileys, whatsapp-web.js and whatsmeow.

Words worth knowing

Gateway: a small program on your own server that logs in to a WhatsApp account so your other software can send and receive messages through it.

Cloud API: Meta's official API for sending and receiving WhatsApp messages as a business. It replaced the self-hosted On-Premises API, which stopped working in October 2025.

Template: a message format Meta approves in advance. It's required for anything you send outside the 24-hour window.

Customer service window: the 24 hours after a customer's last message, when you can reply in free form.

Opt-in: the customer's permission to message them, collected before you write first.

Business Solution Provider: a Meta partner that sets up and runs the Cloud API for a business and charges its own fees.

Coexistence: using the WhatsApp Business app and the Cloud API on the same number at the same time.

Linked device: a computer or browser connected to your WhatsApp account by scanning a QR code. Unofficial gateways log in this way.

Engine: the part of a gateway that actually talks to WhatsApp, either by driving a browser or by speaking WhatsApp's protocol directly.