Your attendance, billing or queueing application only needs to know a destination number and a template name. Contacts, conversations and inbox hygiene are our job — and customer replies come back to your system through HMAC-signed webhooks.
Two endpoints: send a code, verify a code. Random code generation, hashed storage, expiry, attempt limits and resend throttling are all carried for you. Details on the WhatsApp OTP page.
Incoming messages and delivery statuses are forwarded to your endpoint, with a delivery history you can inspect yourself in the dashboard when something looks odd.
Import waco.id/openapi.json into Postman, or generate an SDK in your
language — webhook payload schemas included, not just the endpoints.
AI Operator customers can use the same brain from their own application:
POST /api/v1/asisten/balas — answers from the knowledge you taught it, and
jawab:false when it must be handed to a human.
# send a reminder from your system curl -X POST https://waco.id/api/v1/kirim \ -H "Authorization: Bearer waco_xxxx" \ -H "Content-Type: application/json" \ -d '{ "nomor": "628123456789", "nama": "Ms Ani", "template": "pengingat_janji", "isi": ["Thursday", "15.30"] }' # → {"status":"terkirim","percakapan_id":81}
# OTP: send a code, then verify the answer curl -X POST https://waco.id/api/v1/otp/kirim \ -H "Authorization: Bearer waco_xxxx" \ -d '{"nomor":"628123456789","ref":"login-8842"}' # → {"ok":true,"kedaluwarsa_pada":"2026-08-18T12:05:00Z"} curl -X POST https://waco.id/api/v1/otp/periksa \ -H "Authorization: Bearer waco_xxxx" \ -d '{"nomor":"628123456789","kode":"482913"}' # → {"ok":true,"valid":true,"ref":"login-8842"}
# a customer reply arrives at your endpoint — # header X-WACO-Signature: sha256=… (HMAC of the raw body) POST /your-webhook { "event": "message.received", "dari": "628123456789", "nama": "Ms Ani", "pesan": { "id": "wamid.ABC", "tipe": "text", "teks": "Understood, I will come" } }
Yes — the send API, webhooks and OTP are included in the US$20/month subscription, not sold as an add-on. Message fees still go directly to Meta with no markup.
Every payload is signed with an HMAC using your own secret, so your system can verify that the delivery genuinely came from WACO.
Yes — the API uses Indonesian field names such as nomor, template and isi, exactly as shown above. They are stable and documented in the OpenAPI specification, so generated SDKs match them one to one.
More questions? See the WACO guides or say hello through the chat bubble.