> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hooksnode.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WhatsApp Cloud API

> Receive WhatsApp messages and status updates from Meta.

A WhatsApp source is a webhook source that also answers Meta's handshake and checks Meta's signature. You do not write any server code.

<Info>WhatsApp sources need a Pro project, because the Free plan has one source only.</Info>

## Set up

<Steps>
  <Step title="Add the source">
    In your project, open **Sources → Add source** and pick **WhatsApp Cloud API**. hooksnode shows a **Callback URL** and a **Verify token**.
  </Step>

  <Step title="Paste the values into Meta">
    In Meta for Developers, open your app → **WhatsApp → Configuration**. Paste the Callback URL and the Verify token, then press **Verify and save**. Subscribe to the webhook fields you need, for example `messages`.
  </Step>

  <Step title="Paste the App Secret into hooksnode">
    In Meta, open **App settings → Basic** and copy the **App Secret**. Paste it into the source in hooksnode. From now on, hooksnode checks the `X-Hub-Signature-256` header of each event.
  </Step>

  <Step title="Add a destination">
    Add the endpoint of your bot or support tool as a destination.
  </Step>
</Steps>

## How it works

* **Handshake.** Meta sends `GET /p/<id>?hub.mode=subscribe&hub.verify_token=…&hub.challenge=…`. hooksnode answers `200` with the challenge when the token matches, and `403` when it does not.
* **Signature.** With an App Secret saved, an event with a wrong `X-Hub-Signature-256` gets `401`. Without an App Secret, hooksnode accepts unsigned events and the source page shows a warning.
* **Duplicates.** Meta retries a failed delivery for up to 36 hours with the same body. hooksnode stores each body once, because it uses a hash of the body as the idempotency key.

<Warning>Always save the App Secret. Without it, anyone who knows the URL can send fake events.</Warning>

## Settings

| Setting      | Notes                                                                                  |
| ------------ | -------------------------------------------------------------------------------------- |
| App Secret   | 16 to 256 characters. hooksnode never shows it again. Send an empty value to clear it. |
| Verify token | hooksnode makes it. You can make a new one. Then paste the new one into Meta.          |