Webhook Integration
Overview
Whoxa CRM uses webhooks in two directions:
| Direction | Description |
|---|---|
| Inbound (Meta → Whoxa) | Meta sends all WhatsApp events (messages, status updates) to your API server |
| Outbound (Whoxa → Your System) | Whoxa sends events to your e-commerce or third-party system |
Inbound Webhooks (Meta → Whoxa CRM)
These endpoints are public — Meta calls them directly. Security is verified via the webhook verify token and Meta request signature.
Verification Flow
When you register a webhook URL in Meta, Meta sends a one-time verification request. The server checks that the verify token matches the stored token for the WABA, then responds with the challenge. Meta marks the webhook as verified.
Inbound Event Processing Flow
When Meta sends a message event, the server:
- Identifies the WhatsApp account by phone number ID.
- Creates or updates the conversation and saves the message.
- Downloads any media attachments.
- Checks for an active automation session — resumes if one exists, or starts a new flow if the trigger matches.
- If no automation matches, falls back to default messages (welcome, out-of-hours, or delayed reply).
- Pushes a real-time update to all connected agents instantly.
Supported Inbound Message Types
| Type | Description |
|---|---|
| Text | Plain text message |
| Image | Image file |
| Video | Video file |
| Audio | Audio/voice note |
| Document | PDF or document |
| Sticker | WhatsApp sticker |
| Location | GPS coordinates |
| Contacts | Shared contact card |
| Interactive | Button reply or list reply |
| Button | Quick reply button tap |
| Order | Product order from catalog |
| Reaction | Emoji reaction to a message |
Message Status Updates
Meta also sends delivery and read receipts via the same webhook. Status flow: Sent → Delivered → Read → Failed
Outbound Webhooks (Whoxa → Your System)
Whoxa CRM can push events to your external system (e-commerce store, CRM, ERP) when specific WhatsApp events occur.
Configuration
Go to Settings → Webhooks → Manage Webhooks to:
- Add a webhook endpoint URL.
- Select which events to subscribe to.
- Save and test the connection.
Webhook Logs
Every outbound webhook delivery is logged with:
- Timestamp
- Payload sent
- HTTP status received
- Response body
View logs at Settings → Webhooks → Webhook Logs.
E-commerce Webhook
For e-commerce integrations (Shopify, WooCommerce, custom stores), Whoxa CRM provides a dedicated inbound webhook that receives order events from your store and can trigger automation flows or send order status messages to customers via WhatsApp.
Webhook Security
Outbound webhooks include a signature header so your server can verify the payload came from Whoxa CRM. Each delivery is signed using HMAC-SHA256 with your webhook secret.
Webhook Automation
Whoxa CRM also supports webhook-triggered automations. An incoming webhook payload can trigger a specific automation flow and pass variables from the payload into the flow execution.
Configure at Settings → Webhooks → Webhook Automation.