The number stays in the WhatsApp Business app on your customer’s phone and answers through the official Cloud API at the same time. No number migration, no QR code, no lost chat history.
3 / 3
12.480
It scans a QR code to open a browser session. The session expires, the server restarts, the phone runs out of battery — and someone has to scan the code again. When the account gets banned, the number goes with it.
Your customer authorizes through Meta’s Embedded Signup, inside their own Facebook account. The number then exists in both places at once: the app keeps running on the phone and the Cloud API answers on the same number.
You generate the link, your customer authorizes it in their own Meta account, and the Hub hands back the API key and a signed webhook endpoint. None of it depends on a phone you have to keep plugged in.
Nova organização
Chaves, canais e logs isolados nesta conta
One account per customer of yours. Everything that follows stays isolated inside it.
Link de conexão
Expira sozinho · vale para um cliente
The link is public, expires on its own and is valid for a single customer. Send it however you like.
They open the link, sign in to their own Meta account and authorize. WhatsApp keeps working on their phone.
The API key comes out scoped, and your endpoint starts receiving signed events.
Every endpoint listed here exists and is documented. No catalogue of resources that have not been written yet.
GET/api/v1/channels
Lista os números conectados de uma organização, com o estado de cada um.
POST/api/v1/channels/{id}/messages
Envia por um número. Responde 202: aceita e enfileirada, não entregue.
GET/api/v1/channels/{id}/messages
Histórico de entradas, saídas e ecos do aplicativo, com paginação por cursor.
POST/api/v1/webhooks
Cria um endpoint assinado. O segredo aparece uma única vez, na resposta.
GET/api/v1/logs
Auditoria por período, ação, chave e recurso — quem fez o quê, e quando.
GET/api/v1/usage
Consumo do mês por canal, para você repassar ou só acompanhar.
curl -X POST https://crprohub.com/api/v1/channels/CHANNEL_UUID/messages \
-H "Authorization: Bearer hub_pk_EXEMPLO_NAO_REAL" \
-H "Idempotency-Key: 4a50df76-d6c5-49f3-90a4-13907579d924" \
-H "Content-Type: application/json" \
-d '{"to":"5521999999999","type":"text","text":{"body":"Olá"}}'The response is 202: accepted and queued, not delivered. Final state arrives over the webhook. The Idempotency-Key header is required — replaying the same key with the same body returns the original response instead of sending again.
Every delivery carries the x-hub-signature-256 header with an HMAC SHA-256 of the raw body, computed with a secret shown exactly once, when you create the endpoint. The destination is validated before it is stored: internal addresses, localhost and private ranges are rejected.
HMAC SHA-256 over the raw body, compared in constant time.
Up to ten attempts, from thirty seconds to two days apart.
Twenty consecutive failures pause the endpoint instead of hammering it.
Each additional number unlocks three more webhook endpoints. WhatsApp conversations are billed by Meta, directly on your customer’s account. Subscriptions are billed in Brazilian reais (BRL).
R$97/month
For teams connecting their first customers who want the official contract from day one.
R$147/month
For growing portfolios: more numbers included and a cheaper additional number.
WhatsApp conversations are billed by Meta on your customer’s own account and do not go through this subscription. Subscription prices are charged in BRL.
These are the questions that come up most before the first connection. If one is missing, the documentation answers it in detail.
Open the documentationYes. That is what Meta calls coexistence: the number keeps working in the WhatsApp Business app on your customer’s phone and answers through the Cloud API at the same time. They do not change number, do not lose their conversations and do not have to migrate to a new device.
No. The connection runs through Meta’s Embedded Signup, inside your customer’s own Facebook account. There is no browser session to drop and no QR code to rescan when the server restarts.
Your customer does, on their own WhatsApp Business account. The account belongs to them and conversation billing is settled between them and Meta — you never sit in the middle of that invoice or answer for it.
Every delivery carries the x-hub-signature-256 header with an HMAC SHA-256 of the raw body, computed with a secret only your endpoint and the Hub know. Compare it in constant time and discard anything that does not match.
The delivery is retried up to ten times, with intervals growing from thirty seconds to two days. After twenty consecutive failures the endpoint pauses itself, and you re-enable it in the dashboard once you have fixed what was blocking delivery.
No. Every API key belongs to one organization and every query filters by it at the database level. Requesting another organization’s resource returns 404, not 403 — the existence of someone else’s resource does not leak either.
No, as long as you resend it with the same Idempotency-Key. The header is required on send: the same key with the same body returns the original response, and the same key with a different body returns 409.
Create the organization, generate the link and send it to your customer. They authorize it from their own phone — and the key lands in your hands.