The user’s phone number is automatically used as the
user_id and session_id for runs. Each WhatsApp conversation maps to a single session. Users can send /new to start a fresh session (requires a db on the agent).Setup and Configuration
Prerequisites
Ensure you have the following:
- A Meta Developer Account
- A Meta Business Account (created at Meta Business Manager)
- A valid Facebook account
- ngrok (for development)
- Python 3.9+
Create a Meta App
- Go to Meta for Developers and verify your account.
- Create a new app at the Apps Dashboard.
- Under “Use Case”, select Other.
- Choose Business as the app type.
- Provide:
- App name
- Contact email
- Click “Create App”.
- In the app dashboard, find WhatsApp in the product list and click Set up to add it.
Set Up a Meta Business Account
- Navigate to Meta Business Manager.
- Create a new business account or use an existing one.
- Verify your business email.
- In your Meta App, go to App Settings > Basic and click “Start Verification” under Business Verification. Complete this for production access.
- Associate the app with your business account.
Configure WhatsApp Business API
- In your app dashboard, go to WhatsApp > API Setup.
- Generate a Temporary Access Token. This token expires in ~24 hours and is suitable for development only.
- Copy your Phone Number ID, shown below the test phone number.
- Add a test recipient under the To field (your personal number for testing).
- Go to Meta Business Manager > Business Settings > System Users.
- Click Add and create a new admin-level system user.
- Click on the system user, then Assign Assets.
- Assign your app with Full control.
- Assign your WhatsApp Business Account with Full control.
- Click Generate Token and select
whatsapp_business_messagingandwhatsapp_business_managementpermissions. - Copy and store the token securely. This token does not expire unless revoked.
Set Up Environment Variables
Create a Find these values in your Meta App:
.env file or export these variables:- Access Token: WhatsApp > API Setup (temporary) or System User token (permanent)
- Phone Number ID: WhatsApp > API Setup, below the test phone number
- Verify Token: A string you choose. Must match in both your app and Meta’s webhook config.
Set Up Webhook with ngrok
- Run ngrok to expose your local server, ensuring the port matches your app (7777):
- Copy the
https://URL provided by ngrok. This is your base ngrok URL. - In your Meta App, go to WhatsApp > Configuration and click “Edit” on the Webhook section.
- Configure the webhook:
- Callback URL:
https://<your-ngrok-url>/whatsapp/webhook - Verify Token: The same value as your
WHATSAPP_VERIFY_TOKEN
- Callback URL:
- Click “Verify and save”. Your Agno app must be running locally for verification to succeed.
- After verification, click “Manage” next to Webhook fields. Subscribe to the messages field under
whatsapp_business_account.
Configure Signature Validation
For development, skip signature validation:For production, set your App Secret to enable webhook signature validation:Find the App Secret at App Settings > Basic in your Meta App dashboard.When
WHATSAPP_APP_SECRET is set, every incoming webhook request is validated against the X-Hub-Signature-256 header. Invalid requests receive a 403 response.Test Your Bot
- Start your app:
python whatsapp_bot.py - Ensure ngrok is running and the webhook is verified.
- Open WhatsApp and send a message to the test phone number.
- The bot should respond in the same chat.
- Send
/newto start a fresh session (requiresdbon the agent). - Send an image or document to test media handling.
ngrok is used only for local development and testing. For production deployments, see the deployment tutorials.
Environment Variables Reference
| Variable | Required | Description |
|---|---|---|
WHATSAPP_ACCESS_TOKEN | Yes | Bot access token from Meta App Dashboard or System User |
WHATSAPP_PHONE_NUMBER_ID | Yes | Phone number ID from WhatsApp > API Setup |
WHATSAPP_VERIFY_TOKEN | Yes | User-chosen string for webhook verification |
WHATSAPP_APP_SECRET | Production | App Secret from App Settings > Basic. Enables signature validation. |
WHATSAPP_SKIP_SIGNATURE_VALIDATION | Dev only | Set to true to bypass signature checks in development |
WHATSAPP_ENCRYPTION_KEY | Optional | 64 hex char (32-byte) key for AES-256-GCM phone number encryption |