I have connected WhatsApp Business API to half a dozen production systems over the last two years — a clinic's appointment booking flow, a real estate platform's lead qualification, an e-commerce order-status bot, a SaaS platform's notifications layer. Every project starts the same way: the client assumes it will be "like integrating Telegram", and every project ends with them understanding why WhatsApp is a different beast. Meta controls the door, and the rules are stricter than any other messaging platform I work with.
This is the setup guide I hand new clients before we kick off a WhatsApp project. It covers what you actually need to do, in what order, and the EU-specific pieces that the generic English-language guides tend to skip.
The two paths: Cloud API vs. BSP
Every WhatsApp integration goes through one of two paths. Pick wrong and you pay for it in cost, features, or flexibility for the life of the project.
Meta Cloud API. Direct from Meta. Free message volume up to a threshold that most SMEs never cross, billed per conversation after that. You manage your own webhooks, your own infrastructure, your own template approvals. Best for companies with a competent development team and 1-2 WhatsApp numbers.
Business Solution Provider (BSP). Twilio, MessageBird, 360dialog, Wati, Gupshup. They sit between you and Meta, adding their own API, their own dashboard, and their own markup on every message. Best for non-technical teams, multi-channel needs (WhatsApp + SMS + email under one API), or when you need a pre-built shared inbox for agents.
The pricing gap is real. For a Spanish clinic sending 3,000 utility conversations per month:
- Meta Cloud API direct: around EUR 0 for the first 1,000 service conversations, then ~EUR 0.008 per conversation for utility messages in the Spain/EU tier. Monthly bill: ~EUR 15.
- BSP (Twilio): ~EUR 0.04 per conversation plus ~EUR 0.005 Twilio markup. Monthly bill: ~EUR 130.
- BSP with shared inbox (Wati, 360dialog): EUR 40-80/month subscription plus per-conversation markup.
For a custom build with a development team, Meta Cloud API direct wins on cost by a factor of five or more. For a small business that needs a shared inbox with five agents and does not want to build one, a BSP subscription is the right call. The clinic I built for went direct — their appointment flow was custom anyway, and the EUR 1,000/year saving pays for meaningful additional features.
What you need before you write a line of code
WhatsApp's onboarding is slower than any other API I work with. Start it two weeks before you need to send your first message.
1. A Meta Business Manager account
If your company already uses Facebook Ads or Instagram Business, you already have one. If not, creating it takes ten minutes and requires a valid business address.
2. Business verification
This is the step that breaks timelines. Meta verifies your business identity by cross-checking your company name against government registries, your website domain, and sometimes your utility bills. For a Spanish SL, the verification typically asks for:
- Your CIF number
- A Certificado del Registro Mercantil dated within the last three months
- A phone bill or utility bill in the company name
Timelines range from two days (common) to three weeks (rare but real). Do not build the marketing campaign's launch date around an unverified account.
3. A dedicated phone number
The number you register to WhatsApp Business API cannot be used on the consumer WhatsApp app. This trips up small businesses who want to use their existing company mobile number. Options:
- Port an existing landline or mobile into WhatsApp Business API. The consumer app must be uninstalled first.
- Buy a new virtual number from a provider like Twilio, MessageBird, or Skyetel. A Spanish +34 number costs around EUR 1.50/month.
Virtual numbers are fine for transactional messaging. For two-factor authentication code delivery, some banks and government services reject virtual numbers — test before committing.
4. Display name approval
The name that shows in the customer's chat header ("DaVinci Clinique", not "Juan's Phone") has to be approved by Meta. The approval is usually instant; rejections happen when the name does not match your verified business name or includes promotional language. "Best Clinic in Barcelona" is rejected; "DaVinci Clinique" is accepted.
Message templates — the rule nobody reads carefully enough
WhatsApp divides messages into two classes, and the classification determines whether you can send the message at all.
Service conversations (free-form, within 24-hour window). After a user messages you, you have 24 hours to send them any reply, including images, documents, interactive buttons. Outside that window, Meta will reject the send.
Template messages (pre-approved, any time). A structured message you pre-register with Meta, who reviews it for compliance. Only approved templates can be sent outside the 24-hour window. All marketing and most transactional messages fall into this category.
Template approval is where projects stall. Common rejection reasons:
- Promotional language in a utility template. "Your appointment is confirmed. Book another and get 10% off!" → rejected. Split into a utility template (appointment confirmation) and a separate marketing template with opt-in.
- Variable placeholders without context. "Hi {{1}}, your {{2}} is ready" → rejected. Meta wants examples: "Hi Maria, your order is ready". Provide examples in the template submission.
- Links to unapproved domains. Shortened URLs (bit.ly, tinyurl) get templates rejected. Use your own domain.
Plan at least three business days for each template approval. Submit all templates you need at project kickoff, not the day before launch.
Opt-in: the legal base and the Meta policy
Here is where the EU gets specifically strict. You need two separate permissions to message a European contact:
Meta's opt-in requirement. Every contact you message via WhatsApp Business API must have given you explicit permission, by any lawful means. A checkbox on your website, a physical opt-in form at your clinic, an opt-in keyword sent via WhatsApp ("START" to receive updates). Meta audits this randomly — if your delivery rates drop suddenly, the likely reason is that recipients are reporting your messages and Meta is rate-limiting you.
GDPR legal basis. Separately from Meta's policy, you need a GDPR-compliant legal basis for processing the contact's phone number. For transactional messages (appointment reminders for an existing customer), that basis is usually legitimate interest or contract performance. For marketing, the basis must be explicit consent — an opt-in where WhatsApp marketing is named distinctly from email marketing. A single "I agree to marketing" checkbox is not specific enough under the EDPB's guidelines.
The implementation pattern that keeps you safe: store the opt-in record (timestamp, source, consent text version) alongside the contact record. If Meta or a DPA asks, you can prove consent for any number in your system within seconds.
The architecture I ship for clients
A production-grade WhatsApp integration has four moving parts. Here is the shape of the one that runs for the Barcelona clinic.
Webhook receiver (Django + gunicorn). Meta posts incoming messages and status updates to a URL you register. Sign-verify every request using your app secret; Meta retries failed webhooks for 24 hours, so your handler must be idempotent on Meta's message ID. The handler's job is to accept the webhook in under 5 seconds and enqueue the actual work.
import hmac, hashlib, json
from django.http import HttpResponse
def whatsapp_webhook(request):
expected = hmac.new(
settings.META_APP_SECRET.encode(),
request.body,
hashlib.sha256,
).hexdigest()
signature = request.headers.get('X-Hub-Signature-256', '').removeprefix('sha256=')
if not hmac.compare_digest(expected, signature):
return HttpResponse(status=403)
payload = json.loads(request.body)
# Enqueue; do not process inline
process_whatsapp_event.delay(payload)
return HttpResponse(status=200)Message dispatcher (Celery workers). Outgoing messages go through a queue. Rate limiting is crucial — Meta has both per-phone-number-per-second limits and global per-business limits. Bursting a thousand template messages in ten seconds will get you throttled or temporarily blocked.
State machine per conversation. A customer's journey (booking an appointment, asking about a product) has states. A simple finite state machine stored against the contact works well up to maybe 10-15 states. Beyond that, graduate to a proper workflow engine or, if you want LLM orchestration, a tool-calling agent with explicit state in the system prompt.
Agent inbox (optional). If you want your staff to take over conversations, you need a web interface showing active chats in real time. Django Channels over WebSockets is the minimum; a polished inbox with read receipts, typing indicators, and tagging is a week of work on top of that.
EU-specific gotchas
Data residency. Meta Cloud API stores messages in data centres including the US. For GDPR purposes, Meta publishes a Data Processing Addendum and relies on Standard Contractual Clauses. That is legally sufficient for most businesses, but regulated industries (healthcare, legal, finance) should read the DPA carefully and consider whether WhatsApp is the right primary channel. For the clinic I built for, WhatsApp handles appointment logistics only; any clinical information stays in a GDPR-compliant local platform.
Retention. You can receive and store messages for as long as you have a lawful basis. The default I implement: 24 months for customer conversations, 6 years for anything that touches a transaction (Spanish Commercial Code retention). Beyond that, messages are purged automatically by a nightly job.
Right to erasure. A contact can ask you to delete their data. Your system must be able to delete both the contact record and all associated messages. If you are using a BSP like Twilio, their message logs are separate — you have to issue a deletion request to them as well. Build this as an admin button on day one.
VAT and invoicing. Meta invoices WhatsApp fees from Meta Platforms Ireland. If your business is in Spain, the invoice is intra-EU with reverse-charge VAT. Your accountant needs to know where the invoices come from — forgetting this detail is the single most common bookkeeping mistake I see with WhatsApp projects.
Patterns that save projects
After a few projects the same designs keep earning their keep.
Interactive buttons for common actions. WhatsApp's list messages and reply buttons reduce 80% of free-form input to clicks. For the clinic, "Book an appointment" / "Reschedule" / "Cancel" buttons handled most inbound intent without any NLP. Your chatbot's IQ requirement goes down dramatically when the UI helps the user pick the intent.
Hand-off timer. If the bot has not resolved a conversation in five exchanges, or if the user types certain escalation keywords ("person", "human", "agent", "problema"), hand over to a live agent. The user gets a human in under a minute; the bot does not dig a deeper hole.
Template versioning. Save every template's text against the outgoing message record. When you update a template, the historic messages still reference the version actually sent. Otherwise, six months from now, your message logs will show text that differs from what was delivered, and you will not remember why.
FAQ
How long does the whole setup take?
With business verification running in parallel to development: 3-5 weeks from contract to first template message sent in production. If verification is already done, 2 weeks for a basic integration, 4-6 for something with a state machine and agent inbox.
How much does a basic WhatsApp chatbot cost to build?
For a transactional bot on Meta Cloud API with 3-5 approved templates, state machine, and opt-in logging: EUR 2,500-4,000 fixed price, 3-4 weeks. Add EUR 1,500-3,000 for a full agent inbox. Add EUR 1,000-2,000 for CRM integration.
Can I send marketing campaigns via WhatsApp in the EU?
Yes, if you have explicit opt-in that specifically mentions WhatsApp marketing, and you use pre-approved marketing templates. Success rates (open rates, response rates) are dramatically higher than email, but the opt-out rate is also faster — one "STOP" and the contact must be excluded permanently.
What happens if Meta disables my number?
It happens, usually for policy violations (too many user-reported messages, sending without opt-in, prohibited content). Recovery means an appeal through Business Manager, often requiring changes to your flow. Design to minimise reports: always include opt-out, never message outside consent scope, keep marketing templates under the sending-limit tiers.
Do I need a BSP or not?
If your team is technical, you have 1-2 numbers, and you value cost control — go direct with Meta Cloud API. If your team is non-technical, you need multi-channel (SMS, email, WhatsApp unified), or you want a shared inbox without building one — a BSP like 360dialog or Wati will pay for itself in saved engineering.
Is WhatsApp good for customer support or just notifications?
Both work well. Support conversations are easier to handle in WhatsApp than email (faster turnaround, emoji feedback loop) but require real-time staffing — a customer expecting a chat response will not tolerate a 4-hour reply. Notifications are easier to automate and scale.
Getting started
The honest sequence: get business verification moving today, in parallel decide direct-vs-BSP, in parallel draft your templates. By the time all three converge, development can start with no waiting. Trying to do them in series is how WhatsApp projects take twice as long as they should.
If you want help scoping a WhatsApp integration for an EU business, I offer a 15-minute call where we walk through your use case, your existing systems, and your timeline. I return a fixed-price proposal within 24 hours.