How to Build a WhatsApp Bot With AI (Without the Traps)

A WhatsApp bot built with AI is three pieces: a webhook that receives each incoming message, a call to a language model that drafts a reply, and a request that sends the reply back through Meta's Cloud API. The code is short. The things that trip people up are rules about when you are allowed to send, not how to send.

This guide walks through the loop and then the rules, because the rules decide whether a business bot works in practice.

The loop in plain terms

1. A customer sends a message to your business number.

2. Meta delivers it to your server as a webhook. The Cloud API overview describes webhooks as delivering JSON payloads to your server for incoming messages and message status updates, so you need a public endpoint to receive them. If webhooks are new to you, adding webhooks to an AI-built app explains how to receive and verify them.

3. Your server passes the message, plus the recent conversation, to a model.

4. Your server sends the model's reply as a message.

Outbound messages go through the Graph API. According to the send messages guide, a plain text reply is a JSON body with messaging_product set to whatsapp, a to number, a type of text, and a text object whose body holds the message:

{
  "messaging_product": "whatsapp",
  "recipient_type": "individual",
  "to": "+16505551234",
  "type": "text",
  "text": { "body": "Thanks, your order ships tomorrow." }
}

Authentication uses access tokens, and permissions restrict what each token may reach. Keep the token in a server-side secret, never in client code.

The rule that shapes everything: the 24-hour window

This is the part to understand before writing any code. The send messages guide describes a 24-hour timer called a customer service window. It starts when a customer messages you, and each new message from them resets the timer to 24 hours. Per the same page, while the window is open you can send any of the service message types, and when the window closes you can only send pre-approved template messages.

In practice:

• Replying to a customer who just wrote: free-form text is fine. This is the bot's main job.

• Following up a day later, unprompted: you cannot send free text. You need an approved template.

• Sending a reminder or promotion to someone who has not written: templates only, and only with their consent.

Build this into the bot as a check, not an afterthought. Before every send, compare the time of the customer's last message with now. If it has been less than 24 hours, send the model's reply. If not, either send a template or do nothing and log why.

Templates and opt-in

Template messages are pre-written messages you submit in advance. The Cloud API overview notes that they generally require approval before you can send them, and that they are the only message type that can reach users outside a customer service window. Plan for this:

• Write the templates you will actually need up front: appointment reminder, order update, "we have a reply for you".

• Use variable slots for the changing parts, such as the name and the time.

• Expect that approval takes time, so do not make a launch date depend on a template you have not submitted.

The overview also states that you must obtain user opt-in before sending message templates. Record opt-in per number, with a date and where it was given, and refuse to send a template to anyone without a record. A "STOP" reply should immediately remove the number from template sends.

Making the AI reply safe to send

A model writing to real customers needs limits that a demo does not. Four are worth building from the start.

• Ground it. Give the model your actual opening hours, prices and policies as context, and tell it to say it does not know rather than guess. The guide to keeping an AI chatbot on topic covers the instructions that hold up.

• Constrain the output. Replies should be short, because people read chat on a phone. Set a length limit in the prompt and enforce it in code.

• Hand off to a person. When the customer is upset, asks for a human, or the model is unsure, stop replying and flag the conversation. The pattern is laid out in handing off an AI conversation to a human.

• Add guardrails. A bot can be talked into things. Guardrails for a customer-facing AI chatbot lists what to block and how to test it.

Also decide what the bot may never do on its own. Refunds, discounts and changes to bookings should go through a person or a narrowly scoped tool, not free text.

Handling the messy parts

Real WhatsApp traffic is not tidy.

• Duplicate webhooks. Webhook delivery can repeat. Store each incoming message ID and ignore ones you have already processed, or the bot will answer twice.

• Out-of-order delivery. Use the message timestamps, not arrival order, when building the conversation history.

• Non-text messages. Customers send photos, voice notes and locations. Decide what the bot does with each. The simplest honest answer is to say what it can read and offer a person for the rest.

• Rate limits on your own bot. Someone can send fifty messages in a minute. Cap model calls per number so a single chatty or hostile user cannot run up your model bill.

• Conversation memory. Pass the last handful of messages, not the entire history, to keep calls cheap and replies focused.

A build order that works

1. Get a test number and send yourself a message from the Cloud API console. Confirm sending works before adding a model.

2. Add the webhook and log incoming payloads. Confirm you receive your own test messages.

3. Echo bot: reply with the same text. This proves the full loop and the window check.

4. Replace the echo with the model call, with grounding and a length limit.

5. Add the handoff rule and the duplicate check.

6. Add templates and opt-in storage last, once the free-text path is solid.

Doing it in this order means each step has one new thing that can fail. The parent guide to building an app with AI covers the foundations underneath a bot like this.

Frequently asked questions

Can a WhatsApp bot message customers first?

Only with an approved template message, and only if you have the customer's opt-in. Free-form messages are limited to the 24-hour customer service window that starts when the customer writes to you.

How long is the WhatsApp customer service window?

Meta's documentation describes it as 24 hours, starting when the customer messages you and resetting with each new customer message.

Do I need a developer to build a WhatsApp bot?

You need to host a webhook and keep a token secret, which an AI app builder can scaffold. You still need to review the send rules, opt-in handling and handoff logic yourself, since those cause the real problems.

Is it safe to let AI answer customers on WhatsApp?

It can be, with grounding, length limits, a human handoff and a rule that the bot never commits to money or bookings on its own. Test with hostile and confused messages before going live.