How to send WhatsApp messages from your apps with OpenWA

OpenWA is an API gateway for WhatsApp: you link it to a number and then send or receive messages from your own applications through a REST API. Useful for notifications, order confirmations or a support bot. Important up front: this is unofficial automation with a risk of getting the number restricted, so use a dedicated number, not your personal or company one.

1. Install OpenWA

Pick OpenWA from the app catalog. The interface and API run on port 2785, bound to localhost, so they are not publicly exposed. The default database is SQLite, enough to get started.

2. Access it through an SSH tunnel

Since the interface is bound to localhost, you reach it through an SSH tunnel from your computer:

ssh -L 2785:127.0.0.1:2785 root@SERVER_IP

Then open http://localhost:2785 in your browser. See also SSH key authentication.

3. Connect a WhatsApp number

From the interface you create a session and scan the QR code with the WhatsApp app on the phone holding the dedicated number (Settings, Linked devices). The session stays active on the server.

4. Get the admin key

OpenWA uses API keys, not a password. On first boot it generates an admin key, saved to /opt/openwa/data/.api-key and printed in the logs:

cd /opt/openwa && docker compose logs | grep -i "api key"

5. Send your first message

With the session connected and the key in hand, you send a message through an HTTP request. The exact route schema is in the interactive docs at http://localhost:2785/api/docs. A representative example:

curl -X POST http://localhost:2785/api/messages/send \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"session":"default","to":"40712345678","text":"Hello from my app"}'

From your application code you make exactly the same request, with the key kept as a secret, not in the code.

6. Receive messages through a webhook

For incoming messages or delivery confirmations, you configure a webhook: OpenWA sends a POST to your URL on every event, HMAC-signed so you can verify authenticity. That is how you build a bot that replies automatically.

Rules for responsible use

• Dedicated number: do not link your personal or main company number.
• No cold mass messaging: send only to people who expect the message, otherwise you risk the number being blocked.
• Reasonable pace: respect limits and pauses, do not send hundreds of messages a minute.
• Secrets in environment variables: the API key never goes into public code.

For more complex flows, you can wire OpenWA into an automation engine like n8n.