Connecting WhatsApp Business to n8n: Cloud API, credentials and the 24-hour rule

For a small business, WhatsApp has a property that neither email nor SMS can claim anymore: customers actually reply there. That's not just field intuition — a study by Church and de Oliveira presented at MobileHCI 2013, “What's up with WhatsApp?”, was already comparing WhatsApp and SMS usage and found instant messaging perceived as markedly more conversational, with more frequent and more informal exchanges, especially in groups. A channel where conversation is the norm is exactly what a well-designed automation workflow can build on: instant acknowledgment, answers to frequent questions, escalation to a human when it matters.

The flip side is that WhatsApp is the most demanding messaging channel to wire into n8n. Where a Telegram bot takes two minutes with a single BotFather token, Meta's Cloud API requires a developer app, a WhatsApp Business Account (WABA), a dedicated phone number, tokens to manage properly, and a 24-hour rule that shapes everything your bot is allowed to send. This guide covers exactly those foundations: the Meta-side prerequisites, the two n8n nodes (send and receive), the 24-hour rule, and the move from test number to production.

Why WhatsApp, and why it isn't Telegram

Choosing the channel is a trade-off between audience and technical friction. Telegram offers the simplest API on the market, but your customers probably aren't there. WhatsApp is the opposite: the dominant messaging app in most European and emerging markets, but sitting behind an enterprise API with its own rules, business verification, and template billing.

That friction isn't gratuitous: it's the reason the channel remains relatively unpolluted. No anonymous bot spun up in two clicks, a sender tied to a verifiable business, outbound messages kept in check. For a small business, this means a well-used WhatsApp message lands in a space customers still consider personal — a privilege that must be earned technically, and one that's quickly lost through abuse (Meta watches reports and blocks).

The calculation is simple: if you need an internal channel or a tech-savvy audience, start with Telegram. If you need to talk to customers where they actually reply, WhatsApp is worth the setup friction — and that friction is paid only once.

Meta-side prerequisites: app, WABA and number

Before touching n8n, four building blocks must exist on the Meta side:

1. A Meta developer account (developers.facebook.com), free, tied to your Meta account.
2. A Meta app of type Business, to which you add the WhatsApp product. This app carries the App ID and App Secret the n8n trigger will need.
3. A WhatsApp Business Account (WABA), created or linked when you add the WhatsApp product. It's the container for your numbers, templates and billing.
4. A dedicated phone number. Crucial point: a number can't be registered both in the regular WhatsApp app and on the Cloud API. For development, don't sacrifice any real number: Meta provides a free test number in the developer interface, which can message a small list of recipient numbers you declare. That's plenty to build and test the whole workflow.

Once the WhatsApp product is added, the app's API Setup tab shows the two identifiers n8n will ask for: the Phone Number ID (the number's technical identifier, distinct from the number itself) and the WhatsApp Business Account ID.

n8n credentials: insist on a permanent token

n8n's WhatsApp Business Cloud node authenticates with an access token, alongside the Phone Number ID for sending. And this is where most setups break after a day: the token shown in the Meta developer interface is a temporary 24-hour token. Perfect for validating the connection, disastrous in production — the workflow dies silently the next day.

The clean solution is a System User token, created in Meta Business Settings (Business Settings → Users → System Users):

1. Create a System User (Admin or Employee role, depending on your organization).
2. Grant it access to your app and your WABA.
3. Generate a token with the whatsapp_business_messaging and whatsapp_business_management permissions, choosing “never” as the expiration.

That's the token that goes into the n8n credential. It no longer depends on the developer interface or on anyone's personal session, and it survives an employee leaving. Treat it like any production secret: stored only in n8n credentials, never in a Code node or a workflow field — every reflex from our guide to securing API credentials applies in full.

Sending: the WhatsApp Business Cloud node

With the credential in place, the send node covers three message families:

• Text: the classic free-form message, with the Recipient Phone Number field in international format. This is the format of your automated replies inside the 24-hour window.
• Media: image, document, audio or video, via a public URL or an upload. Useful for sending a PDF invoice, a product photo, a visual confirmation.
• Template: the messages pre-approved by Meta, the only ones allowed outside the 24-hour window. The node lets you pick a template by name and fill in its variables (the {{1}}, {{2}} defined when the template was created in WhatsApp Manager).

A minimal text send comes down to three settings: the Send Message operation, the Phone Number ID (of your sending number), and the recipient. Meta's test number adds one extra constraint: the recipient must be in the list of test numbers declared in the developer interface, otherwise the API rejects the call — a classic error that has nothing to do with n8n.

Receiving: the WhatsApp Trigger node

Receiving goes through the WhatsApp Trigger node, which exposes a webhook Meta will call on every incoming message. Its configuration has two sides:

On the n8n side, the trigger uses a credential distinct from the sending one: your Meta app's App ID + App Secret (the App Secret is used to verify the signature of incoming webhooks — your guarantee that the calls really come from Meta).

On the Meta side, in the Webhooks configuration of your app's WhatsApp product:

1. Enter the webhook URL provided by the n8n node and the verification token.
2. Subscribe the app to the messages field — without this subscription, the webhook verifies successfully but never receives anything, the single most common omission in the whole setup.

The incoming payload follows the nested structure of Meta webhooks. The customer's message sits at the bottom of entry[].changes[].value.messages[]:

{
  "messages": [{
    "from": "447712345678",
    "id": "wamid.XXXX",
    "timestamp": "1722672000",
    "type": "text",
    "text": { "body": "Hi, has my order shipped yet?" }
  }],
  "contacts": [{ "profile": { "name": "Mary D." }, "wa_id": "447712345678" }]
}

Three fields will serve you constantly: messages[0].from (the customer's number, which becomes the recipient of your reply), messages[0].text.body (the content), and messages[0].type (because a customer may send an image or a voice note, which your workflow must at least detect so it doesn't route emptiness into your text logic).

The 24-hour rule: the constraint that shapes everything

This is the rule to understand before writing a single workflow. WhatsApp distinguishes two situations:

• Within 24 hours of the customer's last message: you can send free-form messages — text, media, a reply generated by an AI agent. This is the “customer service window”.
• Beyond 24 hours (or to initiate a conversation): only template messages are allowed. These are models submitted to Meta and approved before use, classified by category (utility, marketing, authentication), and billed per send — Meta has moved to per-message pricing for templates, with amounts varying by country and category; refer to Meta's official pricing rather than any figure found in an article, as the rate card changes regularly.

Concretely, for an n8n workflow: as long as the customer has just written to you, reply freely and at no cost. To follow up three days later, you need an approved template, and every send has a price. This asymmetry has a happy design consequence: it pushes you to build bots that respond rather than bots that solicit — precisely what your customers will tolerate best.

Foundation workflow: receive, route, escalate

Here's the skeleton we recommend for a first WhatsApp workflow, before any sophistication:

1. WhatsApp Trigger — message reception, subscribed to the messages field.
2. Switch node — a first sort on messages[0].type: text continues, media and voice notes go to a holding reply (“an advisor will get back to you shortly”) plus an internal notification.
3. Classification — a lightweight AI node classifies the text: frequent question (opening hours, order tracking, pricing) or complex request.
4. Frequent-question branch — a reply generated by an AI agent, sent through the WhatsApp Business Cloud node. For the bot to hold a real conversation across several messages, it needs per-customer memory — the from number serves as the session key, following the mechanism detailed in our guide to conversation memory for an AI agent.
5. Complex-request branch — no risky automated answer: notify the team on Slack with the context, and optionally add a human approval step with the Wait node if the bot drafts a reply that a human validates before sending.

This skeleton is deliberately minimal: the full version, with an AI agent plugged into your knowledge base to answer from your own documents, is the subject of our dedicated guide to the RAG chatbot on WhatsApp. The present guide stops where that one begins: a clean connection, a token that doesn't expire, and routing that separates what the bot can handle from what it must escalate.

From test number to production

Meta's test number lets you build everything above without spending a cent or committing a real number. Going to production adds two steps:

• Registering a real number on the Cloud API — a dedicated number, reachable to receive the verification code, and not in use in the WhatsApp app.
• Business verification by Meta (Business Verification, in Business Settings): Meta checks the legal existence of your company, documents required. Without it, your number remains under strict limits.

On volume, Meta applies progressive limits on business-initiated conversations (the ones that start with a template): a starting tier, then higher tiers unlocked automatically as your number sends volume with good quality (few blocks and reports). The exact thresholds and their upgrade conditions are documented by Meta and have changed several times — remember the principle rather than the numbers: sending capacity is earned progressively, and the quality perceived by recipients is the key to it. Replies inside the 24-hour window are not subject to these tiers.

Common pitfalls

• Putting the temporary 24-hour token in the n8n credential: everything works on test day, nothing works the day after. Generate a non-expiring System User token from the start.
• Forgetting the subscription to the messages field in the Meta app's webhook configuration: the webhook verifies successfully but the trigger never receives anything.
• Confusing the phone number with the Phone Number ID: the API expects the technical identifier shown in the developer interface, not the number in international format.
• Testing a send to an undeclared number while still on the test number: the API rejects the call as long as the recipient isn't in the test-number list.
• Ignoring the 24-hour rule and trying to send a free-form message outside the window: the API error is confusing if you don't know the rule; outside the window, only an approved template goes through.
• Routing only the text type without planning for the images, voice notes and documents customers send spontaneously: the workflow must at least detect and escalate them.
• Using the company's existing WhatsApp number without realizing it will be removed from the app: get a number dedicated to the API.

In summary

Connecting WhatsApp Business to n8n takes more preparation than any other messaging channel — Meta app, WABA, dedicated number, System User token, webhook subscribed to messages — but each of these steps is done only once, and the result is a channel where your automations talk to customers where they genuinely reply. The 24-hour rule, far from being a mere constraint, sketches the right architecture: a bot that answers fast and well inside the window, templates reserved for follow-ups worth their cost, and human escalation for the rest. If your first goal is precisely to sort and handle incoming requests — on WhatsApp as in your inbox — the Inbox AI Pack (€79) provides ready-to-use workflows for classification, automated replies and escalation, the same underlying logic this guide applies to the WhatsApp channel.