Building on the WhatsApp Cloud API: what a platform needs, and how K-Message does it

Every business that outgrows the WhatsApp Business app reaches the same fork: build our own tool on the WhatsApp Cloud API, or pay for a platform? You cannot answer until you know what the API hands you, and what still has to be built before a team can use it.

The WhatsApp Cloud API is Meta's official interface for sending and receiving WhatsApp Business messages from your own software. Meta hosts it, and anyone with a developer can build on it. But it is plumbing: it sends, receives and reports. No inbox, no staff, no contact list, not a single screen.

At Kerneltics we built our platform, K-Message, on that official API. Here are the parts any serious WhatsApp platform needs: what Meta's documentation says about each, what it means for you, and how K-Message handles it. Building? It is your work list. Buying? Your list of questions.

What the WhatsApp Cloud API gives you, and what it doesn't

Meta's platform overview describes Graph API calls for sending and webhooks for everything coming back, both over HTTPS.

From Meta you get:

• sending text, media, buttons and templates
• a notification for every incoming message and for the status of every message you send
• management of templates, numbers and the WhatsApp Business Account

What someone still has to build:

• a screen your team replies from, and who owns which chat
• customer records, consent and groups
• copies of photos and voice notes before Meta's links expire
• the bot, and the rules for passing a chat to a person
• reporting

That is "the platform". The parts below are in the order you run into them.

1. Webhooks: everything Meta tells you arrives at your server

A webhook is an address on your server that Meta calls whenever something happens: a customer message, a status on a message you sent (sent, delivered, read, failed), a template status change, a change in your number's quality. Meta lists them in its webhooks documentation.

Three details separate a working platform from a demo:

• Accepted is not delivered. The API's reply only means Meta accepted the request; delivery arrives later, as a webhook. A system showing "sent" off that first reply is sometimes wrong.
• The same event can arrive twice. If your server does not answer with HTTP 200, Meta retries for up to 7 days and warns of duplicates. The platform must store each message once by its ID (wamid), or the bot answers it twice.
• Order is not guaranteed. Messages may arrive in a different order from your requests. If order matters, wait for the first message's delivered status before sending the next.

Meta's throughput page adds the load: your webhook server should handle three times your outgoing traffic plus your incoming messages, with a median response under 250 ms and fewer than 1% of requests over a second. So the server acknowledges at once and does the heavy work (bot, storage, reporting) from a queue, or it falls over during the first campaign.

In K-Message: when you send a template you see whether it was delivered, whether it was read and what the customer replied. That is the status webhooks at work.

2. The 24-hour customer service window

Meta's service messages page defines it. When a customer messages or calls you, a 24-hour customer service window opens, and each new message from them resets it. While it is open you can send anything. Once it closes, only a pre-approved template.

What that asks of a platform:

• Staff see whether the window is open before they type. Otherwise someone writes a careful reply to a customer who last wrote yesterday morning, and it fails.
• A closed window switches them to choosing a template instead of free text.

Since 1 October 2026, replies inside the window are charged per message; they used to be free. The arithmetic is in WhatsApp API pricing in Saudi Arabia. A bot that answers in five short messages instead of one now has you paying for five.

3. Templates and template approval

A template is a prepared message with variables (customer name, invoice number) that you can send outside the window. From Meta's template fundamentals:

• Every template has a category: marketing, utility or authentication, which feeds into pricing.
• Review is automatic on creation and on every edit, and can take up to 24 hours. Only APPROVED templates can be sent.
• Approval is not permanent. Recurring negative feedback or low read rates can get a template paused, and repeated negative feedback can get it disabled.
• Meta does not translate templates. Arabic and English are two templates, each reviewed on its own.
• Your allowance depends on verification: 250 templates per account for an unverified business portfolio, up to 6,000 once verified with an approved display name. See WhatsApp Business green tick verification.

A serious platform tracks template status from webhooks, warns you when a live template's quality drops, and ties each template to the event that sends it (an invoice, a reminder) so sending never stops silently. Writing templates that pass review is covered in WhatsApp Business API setup from zero.

In K-Message: templates are approved by Meta and go only to customers who opted in, with delivery, reads and replies tracked. Campaigns go out to contact groups, and during setup we prepare the templates, replies and automation flows for your business.

4. Opt-in and opt-out

Meta's opt-in page says you may message people who gave you their number and agreed to hear from you, and the opt-in must make that clear and name your business. Meta also advises an easy way to opt out, and honouring it.

Why it matters: Meta judges message quality on blocks, reports, mutes and archives over the past seven days, weighted to the most recent, and rate-limits businesses whose quality stays low. Consent keeps the number healthy, so the platform must store it per contact, refuse to send without it, and stop when asked.

In K-Message: every contact carries a consent record with source and date. Sending to a contact without documented consent is refused by the system, not merely flagged. An incoming stop keyword halts future sending to that person automatically, and purchased or scraped lists are not allowed.

5. Embedded Signup: who connects the number, and who owns it

A platform serving many businesses needs Meta's permission to manage their accounts. Per the webhooks documentation, a partner needs advanced access through App Review before clients can grant it the WhatsApp permissions during onboarding. That is part of what makes a company a Meta Tech Provider.

Embedded Signup is then an official Meta window inside the platform, where the owner logs in with their own account, picks or creates a WhatsApp Business Account and verifies the number. Meta states that businesses onboarded this way own their WhatsApp assets, and the provider cannot restrict their access to WhatsApp Manager. Building only for yourself, you skip this and connect your number to your own app.

In K-Message: Kerneltics is a Meta-approved Tech Provider, so you connect your number yourself in Meta's window inside the platform, and the account and number stay in your business portfolio. We guide you through Meta's business verification; the decision is Meta's.

6. A shared inbox: one number, a whole team

Meta knows one number, not the five people answering it. The rest is the platform's job:

• Assignment, so two people never answer one customer and no chat is dropped because everyone assumed someone else had it.
• Internal notes beside the chat, invisible to the customer.
• Routing: sales questions to sales, support to support.
• Media. Per Meta's media page, the link to an incoming photo or voice note expires after 5 minutes, and the file can only be downloaded from Meta for 7 days. Without its own copy, a platform shows you a two-week-old voice note that no longer plays.
• Number format. Meta recommends the plus sign and country code; without the plus, your own country code is prepended and the message may go undelivered or astray. Clean up numbers saved locally as 05 before the first campaign.

In K-Message: one shared inbox for WhatsApp and Instagram, with email alongside, plus assignment, notes and routing. The interface is built right to left in Arabic, not machine translated, and live dashboards show response speed, conversation volume and team performance.

7. Handing a chat from the AI to a person

A chatbot is not a Cloud API feature. Meta delivers the message; the platform decides who answers. The hard part is knowing when the bot should stop:

• It hands over when the customer asks for a person, complains, disputes money, or when it is unsure.
• Once a person takes the chat, the bot goes quiet for that customer.
• Prices and dates come from one source (the knowledge base or your system), never from what sounds plausible.

More on the bot itself in connecting AI to WhatsApp.

In K-Message: an AI agent answers in your brand's voice from your own knowledge base and hands off to a person at any time, alongside an Arabic chatbot, no-code flows and keyword rules that qualify and route customers, and appointment booking.

Build on the WhatsApp Cloud API or buy a platform?

Build when messages come out of your own system and nobody waits to reply: verification codes, shipping updates, invoices. And when a developer will maintain it after launch. You need webhooks, templates and consent, not an inbox or a bot.

Buy when people answer. The inbox, media storage and the bot's handover are never finished on launch day, and Meta keeps changing the rules (the October 2026 billing change, for one).

Many businesses need both: notifications leaving their system on their own, and a team handling what comes back, as in Odoo WhatsApp notifications.

Questions to ask any WhatsApp platform

1. If your server is down for an hour, what happens to messages that arrived? How do you stop duplicates?
2. Can staff see that the 24-hour window has closed before they type?
3. Do you track template status and quality, or will I hear about a paused template from customers?
4. Where are photos and voice notes stored, and for how long?
5. How do you record consent, and how does a customer opt out?
6. Do you onboard through Embedded Signup, with the account and number in my business portfolio?
7. Does the bot go quiet when a person takes the chat, and when does it come back?

A platform with clear answers to all seven has built the parts above.

FAQ

Is the WhatsApp Cloud API free?

Meta charges for the messages by category, and since October 2026 that includes replies inside the window. The test number Meta creates when you start can send templates without a payment method, but only for testing. Build it yourself and you pay a developer and a server instead of a subscription. Details in WhatsApp API pricing.

What is the difference between the "WhatsApp API" and the WhatsApp Cloud API?

"WhatsApp API" is the everyday name for Meta's WhatsApp Business Platform; the Cloud API is the version Meta hosts, and what most platforms mean today. The phone app is a different product, compared in WhatsApp API vs the WhatsApp Business app.

If a platform stops suiting me, do I lose my number?

Not if you signed up through Embedded Signup: the account and number sit in your business portfolio and the templates on your account. What you can lose is whatever only the platform holds, such as conversation history, media and bot settings, so ask how to export them before you sign.

How we do it

We connect your number to K-Message through Embedded Signup, guide you through Meta's verification, and write your templates and consent setup before the first campaign. Then we build the bot's knowledge from your real information, set when it hands over, and train your team. K-Message is an independent product by Kerneltics, not affiliated with Meta or WhatsApp.

See our WhatsApp API page, or book a consultation to work out whether you need a platform at all, or just a direct connection from your own system.