Send WhatsApp via Integration API

Authentication

Auth uses a Local API Key inside the request body (`api_key` field), not an HTTP header. Each business has one Local API Key (UUID) that is generated automatically when the business is created.

How to get the Local API Key

1. Sign in to the cshub panel at /app.
2. Open Settings → API Key (or Profile → Integration).
3. Copy the Local API Key. You can regenerate it anytime — the old key becomes invalid immediately.

Endpoint

A single endpoint covers every WhatsApp Unofficial (whatsmeow) send. Pick method = text for free-form messages, or method = template to send a template you already configured in the panel.

Body fields

Body is JSON. Fields below are parity with whatscrmhub Laravel — migrating from the older version, the request shape is identical.

Request examples

1. Send a simple text message

curl -X POST "https://api.cshub.id/api/v1/integration/whatsapp/send-message" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "<LOCAL_API_KEY>",
    "device_key": "<DEVICE_ID>",
    "phone": "6281234567890",
    "method": "text",
    "text": "Halo, makasih udah order ya!"
  }'

2. Send a template with variable substitution

curl -X POST "https://api.cshub.id/api/v1/integration/whatsapp/send-message" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "<LOCAL_API_KEY>",
    "device_key": "<DEVICE_ID>",
    "phone": "6281234567890",
    "method": "template",
    "template": "<TEMPLATE_ID>",
    "variables": {
      "$name": "Pak Budi",
      "$order_id": "INV-20260602-001"
    }
  }'

3. Send to a group (use group JID)

curl -X POST "https://api.cshub.id/api/v1/integration/whatsapp/send-message" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "<LOCAL_API_KEY>",
    "device_key": "<DEVICE_ID>",
    "phone": "120363012345678901@g.us",
    "method": "text",
    "text": "Pengumuman: order minggu ini ditutup pukul 17:00.",
    "is_group": true
  }'

Success response (200 OK)

{
  "status": true,
  "message": "berhasil mengirim pesan"
}

Error codes & fixes

Notes & limits

• There is a daily_send limit per device. Avoid blasting more than ~10 messages/second from a single device to avoid WhatsApp bans.
• If your business has `api_device_use = required`, the `device_key` field is mandatory. With it optional, the server picks an active device based on the `whatsapp_sender_notif` setting (`sequence` / `spin` / `random`).
• Variable substitution uses literal `str_replace` — placeholders can be any string (e.g. `$name`, `{name}`, `[NAME]`). It just needs to match the text inside the template message exactly.
• Always format without "+" and without spaces/dashes. Example: 6281234567890 (Indonesia), 60123456789 (Malaysia). For groups, use the full JID with the `@g.us` suffix.
• MVP iteration: binary file upload via multipart/form-data is not supported yet. To send media, use method=template with a template that already has an image configured in the panel.

Integration API vs Internal Panel API

cshub deliberately keeps two send-message paths. The Integration API is for third-party developers and automation; the Internal API powers the cshub web panel and mobile app. Different audience, different auth, different response shape.