WhatsApp Business API: Cloud API Setup, Costs and Limits

The WhatsApp Business API is Meta's interface for sending and receiving WhatsApp messages from business software, and in 2026 it means one thing: the Cloud API, hosted by Meta and called through the Graph API. The On-Premises API stopped delivering messages on 23 October 2025. Connecting a number takes five ordered calls; missing inbound messages usually mean one was skipped.

What is the WhatsApp Business API in 2026?

The WhatsApp Business API is how a CRM, an ERP or a booking system sends and receives WhatsApp messages directly, instead of a person typing in the WhatsApp Business app on a phone. Since the On-Premises API was sunset there is only one version, Cloud API. The timeline Meta published:

• From 1 July 2024, a business phone number can only be registered for Cloud API. Trying to register one for On-Premises returns error code 1005.
• On 23 October 2025 the final On-Premises client, v2.63, expired, and messages to or from numbers still registered on it are not delivered.
• A new business portfolio (what Meta used to call Business Manager) is initially capped at two registered business phone numbers.

Any guide that still asks you to choose between Cloud and On-Premises is out of date. If the real question is whether you need the API at all, see WhatsApp Business app vs API.

How much does the WhatsApp Business API cost, and what changes on 1 October 2026?

Since 1 July 2025 Meta charges per delivered template message, at a rate set by the template's category (marketing, utility or authentication) and the recipient's country calling code. Israel (972) has its own entry on the rate card. Until 30 September 2026, free-form replies inside the customer service window cost nothing. As of September 2026, Meta's pricing page describes the switch like this:

The 1,000-message service free tier is per business phone number, resets monthly with no roll-over, and group deliveries draw from it per delivered recipient. Current Israeli rates and a worked estimate are in WhatsApp Business API pricing explained.

The customer service window and template categories

The customer service window is a 24-hour timer that starts when a WhatsApp user messages or calls your business number, and resets each time they message or call again. While it is open you can send any message type. Once it closes you can only send an approved template, and a free-form send fails with error 131047. The three categories:

• Marketing - awareness, offers, re-engagement. The most flexible category.
• Utility - must be non-promotional, and either specific to the user (an order, account or transaction) or essential to them.
• Authentication - the only category allowed to carry a one-time passcode for identity verification.

Meta can re-categorise a template after approval, for example a utility template it judges to be marketing, and every send accepts the charge of the category applied at the time of use. Why templates get rejected, and how to word them so they pass, is covered in the template approval guide.

How many people can a new WhatsApp number message per day?

A new business portfolio can deliver messages to 250 unique WhatsApp users in a moving 24-hour period, counting only messages sent outside a customer service window. The limit is set at portfolio level and shared by every number in it, so one number can use all of it. Replies to people who wrote to you first do not count.

• 2,000 - requires one scaling path: verify your business, have the partner who onboarded you verify it, or deliver 2,000 messages outside service windows to unique users within 30 days using templates with a high quality rating.
• 10,000, 100,000 and unlimited - automatic, one level at a time within 6 hours, when message quality is high and you used at least half of the current limit in the last 7 days.

To read the current limit through the API, request the whatsapp_business_manager_messaging_limit field on the phone number. The older messaging_limit_tier field is deprecated, so code that still reads it needs updating. Start business verification in parallel with development rather than on launch day.

Connecting a number to Cloud API: the setup order

The order matters because two of these steps fail without a clear error. Before starting you need a business portfolio, a Meta app with the WhatsApp product (app_id and app_secret), a WABA with its waba_id, a number with its phone_number_id, a System User token carrying whatsapp_business_messaging, and a public HTTPS endpoint that is already deployed. A short-lived Graph API Explorer token fails later with code 190, meaning the access token has expired.

1. Find the phone number ID. GET /{waba_id}/phone_numbers. The ID is not the phone number, and nearly every later call uses it.
2. Configure the app-level webhook. POST /{app_id}/subscriptions with object=whatsapp_business_account, callback_url, verify_token, fields, and an App Access Token of the form APP_ID|APP_SECRET - not the messaging token. Meta sends the GET verification to callback_url during this call, so your server must already answer 200 with the hub.challenge value.
3. Subscribe the WABA to the app. POST /{waba_id}/subscribed_apps. This is a separate call and never happens automatically. Without it outbound sending works and no inbound event ever arrives. Confirm with a GET on the same path.
4. Register the number. POST /{phone_number_id}/register with messaging_product: "whatsapp" and a 6-digit pin. If two-step verification is already on, the PIN must be the existing one; if not, the value you send becomes the new PIN. You get 10 requests per number per moving 72 hours; the next returns 133016 and blocks registration for 72 hours. An unregistered number fails every send with 133010 or 131045.
5. Check health. GET /{phone_number_id}?fields=health_status. The can_send_message value is AVAILABLE, LIMITED or BLOCKED, aggregated across every node involved in a send: the app, the business portfolio, the WABA, the number and the template. A BLOCKED node comes with an errors property explaining why.

In fields, subscribe to at least messages, message_template_status_update, message_template_quality_update, template_category_update and user_id_update. What each failure code means is in WhatsApp Cloud API error codes, and building a bot on top of this connection is in how to create a WhatsApp bot.

Handling the inbound webhook

A WhatsApp webhook endpoint receives two request types, and each has its own rule:

• GET for verification. Compare hub.verify_token with the string you stored. On a match return 200 with the hub.challenge value; otherwise return a 400-level status.
• POST for events. The X-Hub-Signature-256 header holds sha256= followed by an HMAC-SHA256 of the payload, keyed with the app secret. Compute it over the raw bytes: JSON that was parsed and re-serialised changes key order and whitespace, and the signature will not match. Behind a proxy, mount the webhook route before the body parser.
• Return 200 quickly. On any non-200 response Meta retries with decreasing frequency for up to 7 days, and retries go to every app subscribed to the WABA. Duplicates are therefore normal; deduplicate on the message ID.
• Size. A webhook payload can be up to 3 MB.

Why does a WhatsApp webhook arrive without the customer's phone number?

Since early April 2026 every messages webhook carries a business-scoped user ID (BSUID) in user_id, and a user who adopts a WhatsApp username can arrive with no phone number at all. According to Meta's documentation, the number is included only if you messaged or called that number in the last 30 days, they messaged or called you in the last 30 days, or they are in your contact book. The 30-day conditions are evaluated separately for each business phone number.

• A BSUID is a two-letter country code, a period, and up to 128 alphanumeric characters, for example US.13491208655302741918. It is unique to each business portfolio and user pair.
• It is regenerated when the user changes phone number, and a user_id_update webhook announces the change.
• To send to a BSUID, set recipient and omit to. This works for every message type except one-tap, zero-tap and copy-code authentication templates.
• An integration that identifies customers only by wa_id will drop these messages with no error. Store both identifiers and look up by both.

For what building and running a system like this costs, see how much a chatbot costs.

Sources

• Meta - Pricing on the WhatsApp Business Platform
• Meta - Messaging Limits
• Meta - Business-scoped user IDs