OpenWA

OpenWA is an MIT-licensed, self-hosted WhatsApp API gateway built by Yudhi Armyndharis (rmyndharis) and community contributors. It exposes WhatsApp messaging through a REST API, a bundled React dashboard, and HMAC-signed webhooks, and the latest release listed is v0.25.0.

What It Is

OpenWA is a gateway that connects to WhatsApp through unofficial, reverse-engineered clients (whatsapp-web.js by default, or baileys via the ENGINE_TYPE setting) rather than Meta's official Cloud API. Developers run it on their own infrastructure, link a number by scanning a QR code, and then send and receive messages over HTTP. The project states it is independent and not affiliated with Meta or WhatsApp.

How the Workflow Operates

You create a session, start it, scan the QR code, and then call endpoints such as send-text, media, reactions, edits, bulk sending, groups, channels, and labels. Webhooks deliver events like message.received and session.status, with optional filters on fields such as sender, chatId, or type. Multiple WhatsApp sessions can run concurrently on one instance, with optional per-session proxies.

Access Control and Pluggable Infrastructure

API keys can carry admin, operator, or viewer roles and can be restricted to specific sessions and, in newer releases, to specific chats. Other controls include CIDR IP whitelisting, rate limiting, and audit logging. Database (SQLite or PostgreSQL), storage (local, S3, or MinIO), and cache (memory or Redis) are swappable by configuration. Deployment is via Docker Compose with multi-arch images and optional postgres, redis, minio, and full profiles.

Ecosystem and AI Agent Access

OpenWA offers an optional MCP server, off by default, that exposes 25 read-only tools or 51 tools with writes enabled. It also lists official SDKs for JavaScript/TypeScript, Python, and PHP, n8n community nodes, a sandboxed plugin system, and a community ioBroker adapter.

Tradeoffs to Know

The README warns there is always a non-zero risk of account restriction or ban, recommends a dedicated number, and advises against regulated or compliance-sensitive deployments, pointing to the official Cloud API instead. The two engines differ: whatsapp-web.js is described as lower risk but heavier on RAM, while baileys is lighter but easier to fingerprint.