Open source · Self-hosted · AGPL-3.0

Your WhatsApp infrastructure.
Not theirs.

Self-hosted WhatsApp Business API and control plane for Cloudflare Workers. Full database and credential ownership, zero per-message markup, built-in MCP server, and instant risk-free sandbox.

Deploy to Cloudflare → View source on GitHub
1-click deploy • Free sandbox • No Meta credentials required
openwa.your-company.workers.dev
● Sandbox Active
● Overview
Sandbox
Connection
Access & tokens
Logs
Webhooks
MCP
Messages
4
Webhooks
2
Audit
6
Recent simulated activity
Simulated Send #15550001001 delivered
Webhook received (messages) processed
POST /v1/messages cURL API 
# Send WhatsApp message via OpenWA
curl -X POST https://openwa.example.workers.dev/v1/messages \
  -H "Authorization: Bearer sec_live_9a7f..." \
  -H "Content-Type: application/json" \
  -d '{
    "phone_number_id": "1098234857",
    "to": "+15550001001",
    "type": "text",
    "text": { "body": "Your order #4829 is confirmed!" }
  }'
Zero message markup

Connect directly to Meta Graph API. No per-message fees or volume markups whatsoever.

Single-tenant by design

One deployment, one Cloudflare D1 database, one owner. Strict data sovereignty.

Credentials stay with you

Meta tokens and app secrets are encrypted locally with PBKDF2/AES-GCM. Never shared.

Auditable open source

AGPL-3.0 licensed. Full visibility and control over all code, queues, and MCP tools.

Platform

Everything to run WhatsApp Business.
One self-hosted deployment.

Replace proprietary CPaaS lock-in with serverless primitives on your own Cloudflare account.

Fast control plane

Modern responsive developer dashboard with instant 0ms tab navigation, in-memory state caching, and live sandbox request explorer.

REST API & webhooks

Scoped bearer tokens, idempotent sends, deduplicated webhook receipts, and structured JSON error responses.

Queue-backed delivery

Outbound message dispatch with automatic retries, per-phone rate limiting, and dead-letter safety on Cloudflare Queues.

Built-in MCP server

Native Model Context Protocol endpoint at /mcp exposing messages, logs, and send tools to Claude Desktop and Cursor agents.

Customer records in D1

Store conversations, contacts, message delivery logs, and webhook receipts directly in your Cloudflare D1 SQL database.

Zero telemetry

No phone-home trackers, no third-party analytic pings, and no vendor lock-in. Full data export and purge controls.

Get started

Deploy. Test risk-free. Connect.

Get a complete WhatsApp Business API stack running in minutes without needing Meta approval beforehand.

01 / ONE-CLICK PROVISION

Deploy in 60 seconds

Click Deploy to Cloudflare to automatically provision your Worker, D1 database, queues, and media storage on your account.

02 / RISK-FREE SANDBOX

Test immediately

Initialize your owner account and send simulated messages right away in the sandbox. Zero Meta setup or credit card required.

03 / CONNECT PRODUCTION

Go live with Meta

Whenever you are ready, enter your Meta Business credentials in Connection settings to seamlessly route live production traffic.

Security

Ownership by architecture.

Single-tenant isolation and cryptographic guarantees protect your business credentials and customer messages.

✓
Client-derived PBKDF2 authentication

Owner passwords are derived in the browser using PBKDF2-SHA-256 with 600,000 iterations. Plaintext passwords never hit the network.

✓
Encrypted credentials at rest

Meta access tokens and app secrets are encrypted with AES-GCM using keys unique to your installation.

✓
HMAC-SHA-256 webhook signatures

Inbound webhook events from Meta are cryptographically verified using X-Hub-Signature-256 before any message is stored.

✓
Cloudflare Access SSO integration

Optionally bind team access to Cloudflare Access Zero Trust with immutable subject claims and local role authorization.

Ready to deploy?

Own your WhatsApp infrastructure today.

Deploy your single-tenant WhatsApp control plane in minutes. Test in the sandbox without risk, and connect your phone number when you are ready.

Deploy to Cloudflare → View source on GitHub
1-click deploy • Free sandbox • No Meta credentials required