Quick start
What it does. WhatsApp messages to customers for order updates, one-time codes and promotions, sent to the phone number on their account or guest order. Uses message templates approved in your own WhatsApp Business account, through the WhatsApp Cloud API, Twilio or Gupshup.
Who can use it
- Off until you switch it on.
- Your plan decides whether you can use it. The module card in Settings → Modules shows Not in your plan (with See plans) or Paid add-on (with Buy add-on) when it is not included. The features list shows which plans include it.
Switch it on
- In your admin, open Settings → Modules.
- Find WhatsApp Notifications. If it is on the Installed tab, click Enable; if not, open the Browse tab and click Install.
- Click Configure, fill in Provider, and save.
Switching it off later stops it working but keeps its data, so switching it back on picks up where you left off.
Where to find it
- Settings → Messaging
Settings
- Provider — Which service delivers this channel's messages. Required.
- Access token (WhatsApp Cloud API) — WhatsApp Cloud API: A permanent system-user token with the whatsapp_business_messaging permission. Stored encrypted; after saving it shows as hidden.
- Phone number ID (WhatsApp Cloud API) — WhatsApp Cloud API: WhatsApp Manager → API setup → Phone number ID (not the phone number itself).
- App secret (WhatsApp Cloud API) — WhatsApp Cloud API: Meta app dashboard → App settings → Basic. Verifies the X-Hub-Signature-256 of every webhook; without it webhooks are rejected. Stored encrypted; after saving it shows as hidden.
- Webhook verify token (WhatsApp Cloud API) — WhatsApp Cloud API: Any string you choose. Enter the same value as the verify token when you subscribe the webhook in the Meta app dashboard. Stored encrypted; after saving it shows as hidden.
- Graph API version (WhatsApp Cloud API) — WhatsApp Cloud API: For example v25.0. Meta retires versions about two years after release. Default: v25.0.
- Account SID (Twilio WhatsApp) — Twilio WhatsApp: Starts with AC. Shown on the Twilio Console dashboard.
- Auth token (Twilio WhatsApp) — Twilio WhatsApp: Also verifies the X-Twilio-Signature on delivery callbacks. Stored encrypted; after saving it shows as hidden.
- WhatsApp sender number (Twilio WhatsApp) — Twilio WhatsApp: The WhatsApp-enabled Twilio number in E.164, without the whatsapp: prefix. Required unless a Messaging Service SID is set.
- Messaging Service SID (Twilio WhatsApp) — Twilio WhatsApp: Starts with MG. When set it is used instead of the sender number.
- Status callback URL (Twilio WhatsApp) — Twilio WhatsApp: This store's messaging webhook URL for this provider. Sent with every message so delivery and read receipts come back.
- API key (Gupshup) — Gupshup: Gupshup dashboard → your app → API key. Stored encrypted; after saving it shows as hidden.
- App name (Gupshup) — Gupshup: The Gupshup app name (sent as src.name).
- WhatsApp business number (Gupshup) — Gupshup: The number registered on the app, with country code, e.g. +919876543210.
- Webhook shared secret (Gupshup, Console) — Gupshup: Any long random string. Callbacks are accepted only when the callback URL carries ?token=<this secret>. Console: Simulated delivery reports are accepted only with ?token=<this secret> or an X-Webhook-Token header. Stored encrypted; after saving it shows as hidden.
- Default country — Two-letter country code (for example IN) applied to phone numbers saved without a country code. Empty uses the store country.
- Quiet hours start — HH:MM in the store time zone. Marketing messages are held between start and end; order and one-time-code messages are not.
- Quiet hours end — HH:MM in the store time zone.
- Messages per second — Upper limit on sends per second for this channel. 0 uses the provider's own limit.
Questions? See the store guide or contact CartWhizz support.