Inbound: how does your system start a WhatsApp flow?
Your system sends a signed POST to your workspace's inbound address:
POST /api/webhook/inbound/<your-workspace-slug>/<event_name>
The event name matches the trigger in a published flow, so a payload for order_shipped starts the flow built for that event. The protections on this endpoint:
- HMAC-SHA256 signature in the signature header (format
sha256=<hex>), checked in constant time against your workspace's webhook secret, which you generate in the app. - Replay protection: the timestamp header must be within five minutes.
- Idempotency: each event carries an id, and a repeated id is ignored, so retries do not double-send.
- Validation: the body is limited to 64 KB, the customer phone must be in international (E.164) format, and requests are rate limited per workspace (60 a minute).
Outbound: how does InboxWA push events to you?
Register one HTTPS endpoint per workspace and choose the events. Each delivery is a signed POST with the event name, a timestamp, a correlation id for de-duplication and an X-Webhook-Signature header (sha256= plus the hex HMAC-SHA256 of the raw body). The full signing and replay-protection guide, with Node.js, Python and PHP code, is in the developer guide.
| Plan | Outbound webhook events |
|---|---|
| Starter | None. Starter has no API and no webhooks. |
| Growth | 5 core events: message received, message sent, contact created, handoff, tag added |
| Scale | All 11 events, adding message status, conversation seen, assigned, resolved, SLA breached and credits threshold |
Source: InboxWA API reference, "Plans and API access", reviewed 11 October 2026.
Delivery behaviour you should design for
- Answer with any 2xx quickly and do slow work afterwards.
- Up to three attempts (immediately, then after 1 and 4 seconds) on network errors and 5xx responses. A 4xx is treated as a rejection and not retried. Each attempt times out after 8 seconds.
- An event that fails every attempt is not delivered again. A delivery log and a test endpoint are provided so you can catch up.
- Events can arrive more than once or out of order, so de-duplicate on the correlation id.
Related connections
No-code tools such as Zapier and Make connect through the same API and webhooks (Growth and Scale). Full reference: API documentation.
This page describes what the integration does today, including its limits. If you need something it does not do, our custom integration service scopes it as a project.
Frequently asked questions
Does InboxWA support webhooks?
Yes, in both directions. Your systems can send signed events to start flows, and InboxWA can push events such as new messages and handoffs to your endpoint. Outbound webhooks are on Growth (5 events) and Scale (11 events); Starter has none.
How are InboxWA webhooks signed?
With HMAC-SHA256. The signature header is sha256= followed by the hex digest of the raw request body, keyed with your signing secret. Verify it in constant time before trusting the payload.
What happens if my endpoint is down?
Delivery is attempted up to three times with short waits. An event that fails every attempt is not delivered again, so use the delivery log to catch up, and design for duplicates and out-of-order events.
Can Zapier or Make use the same webhooks?
Yes. Zapier and Make work through the API and webhooks on the Growth and Scale plans.
Try it on your own account
Plans from ₹999/month, zero markup on Meta's message fees. 7-day free trial, no card required.