By KYN AI Advisory Team — AI implementation specialists, Singapore
To connect an AI agent to WhatsApp you use the WhatsApp Business Platform (the Cloud API), not the WhatsApp Business app. The setup has eight steps: a verified Meta business account, a phone number that is not in use on WhatsApp, number registration, a system user token, a webhook that receives messages, approved message templates, an approval gate for outbound messages, and tests. The agent reads and drafts. A named person approves anything that goes out under your name.
What do you need before you start?
- A Meta business portfolio (formerly Business Manager) for your company. Business verification may be asked for as you scale usage.
- A phone number that can receive an SMS or a voice call for verification. Meta's phone number documentation explains the rules. A number already registered to the WhatsApp consumer or Business app has to be removed from it first.
- A public HTTPS endpoint you control, for the webhook. This runs in your own cloud account.
- A place to store secrets: a secrets manager, not a code repository.
- An owner on your side who can approve templates and read the quality ratings.
If you are deciding between the app and the platform, read WhatsApp Business app vs WhatsApp Business Platform. For costs, see WhatsApp Business API cost in Singapore. Meta changes its pricing model, so check the current rate card on Meta's site before you budget.
What are the setup steps?
Meta's Cloud API Get Started guide is the reference. The flow below follows it and adds the controls an agent needs.
- Create an app and connect a WhatsApp account. In the Meta developer dashboard, create an app, add the WhatsApp product and link it to your business portfolio. Meta generates a test number so you can send a first message before you touch your real number.
- Add your real business number. Add it in WhatsApp Manager and verify it by SMS or call. Set the display name, which Meta reviews.
- Register the number for the Cloud API. Meta states that adding a number verifies ownership but does not register it for Cloud API use. You call the registration endpoint and set a six-digit two-step verification PIN. Store that PIN in your secrets manager. See Meta's registration documentation.
- Create a system user and a permanent token. The temporary token from the dashboard expires. For production, create a system user in Business Settings, assign it the app and the WhatsApp account, and generate a token with the messaging and management permissions Meta lists. Rotate it on a schedule and revoke it when a person leaves.
- Configure the webhook. In the app dashboard, set the callback URL and a verify token you choose. Meta notes that an app has one webhook endpoint, so route traffic for all your numbers through one service and split inside it. Verify the signature on every inbound request before you process it.
- Create message templates. Templates are pre-approved message formats with variables. Submit them in WhatsApp Manager, wait for approval, and track quality ratings. Write them plainly and give each a single purpose.
- Build the agent behind the webhook. The endpoint receives a message, stores it, and hands it to the agent. The agent classifies, looks up the customer, drafts a reply and queues it. Section below.
- Test with real devices. Send each message type from a handset: text, image, voice note, document, a reply to a template, an opt-out. Confirm each lands in the log and each draft appears in the queue.
How should the agent sit behind the webhook?
Keep the pipeline small and each step checkable.
- Receive. The webhook verifies the signature, writes the raw payload to storage and returns 200 quickly. Processing happens in a queue, so Meta does not retry while your agent is thinking.
- Deduplicate. Meta can deliver the same event more than once. Key on the message ID and ignore repeats.
- Identify. Match the sender's number to a customer record. Unknown numbers go to a triage queue with no automatic reply.
- Understand. The agent labels the message (question, order, complaint, opt-out, other) and extracts fields (order number, date, product).
- Draft. The agent writes a reply from your approved facts: price list, stock, opening hours, policy text. It cites the source record it used.
- Gate. The draft waits for a named person if it quotes a price, makes a promise, answers a complaint or goes to a new contact. Low-risk replies, such as an order status taken straight from the system of record, can go out on a template.
- Send. Your backend calls the send endpoint. The agent has no send credential.
- Log. Message ID, actor, template, approver and time.
Voice notes and images are common on WhatsApp. Decide how the agent handles them: transcribe voice notes and read images, store the original, and mark any low-confidence extraction for a person.
What rules apply to messaging customers?
- Consent. Meta's policies require a basis for contacting people. In Singapore, the PDPC's Do Not Call Registry guidance covers marketing messages to Singapore telephone numbers. Check the rule for each recipient country.
- Opt-out. An opt-out message must stop all outbound messages to that number, in every channel, from the next run. Test it.
- Content. Keep message content within Meta's WhatsApp Business policies. Do not send what the policy forbids.
- Quality. Meta rates number quality from user feedback. A bad rating can lower your messaging limits. Send fewer, more relevant messages.
The agent should not invent facts. If a customer asks for a delivery date and the system of record has none, the draft says a person will check, and a person does.
What can go wrong?
| Failure | Cause | Control | |---|---|---| | Agent replies to a number it should not | Unknown sender not triaged | Unknown numbers queue for a person | | Duplicate replies | Webhook retries processed twice | Key on message ID | | A price quoted that does not exist | Model guessed | Quote only from the price table, gate every quote | | Token expires, messages stop | Temporary or unrotated token | System user token, expiry alert | | Opt-out ignored | Suppression checked in one channel only | One shared suppression list | | Hostile instruction in a message | Prompt injection | Treat message text as data, limit tools. See prompt injection in business AI agents |
Where KYN fits
KYN builds WhatsApp systems that run in your own cloud account: webhook, queue, agent, review screen and log. For a manufacturer, a 06:30 morning report goes to each department on WhatsApp at about S$0.05 per report; see the daily WhatsApp operations report. Agents use their own restricted accounts, every action is logged with the actor, and outbound messages wait for a named person. See integrations.
The first 14 days are a review of your stack and interviews with your team. A full build ships in under 90 days.
Frequently asked questions
Can I keep using the WhatsApp Business app on the same number?
A number registered to the Cloud API is separate from the consumer or Business app. Check Meta's current documentation on whether the app and the API can share a number. Plan for your staff to answer from a shared inbox or your own review screen.
Do I need a developer to set this up?
Steps one to four can be done by a technical administrator. The webhook, queue and agent are engineering work. A hosted provider can cover the plumbing, at a per-message or per-seat fee.
Can the agent message customers first?
Only through approved templates, to people who have consented, and with each campaign approved by a named person. Replies to inbound messages are the safer starting point.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
