n8n WhatsApp Business API integration: no-code automation through WACO

n8n, Make, and Zapier need just two things to talk to WhatsApp through WACO, and both come with every plan: a webhook that pushes every incoming message into your flow, and an API to reply or send templates. No custom node to install; the built-in Webhook and HTTP Request nodes are enough. This guide uses n8n as the example; the same pattern applies to Make and Zapier.

What you need

• A WACO account with a connected number and an API key (waco_…) from the Developer page, see the API quickstart.
• The webhook secret (whsec_…) shown when you save a webhook URL on the same page, see the webhook guide.
• n8n Cloud, or a self-hosted n8n reachable over HTTPS.

Step 1. Import the example workflow

Copy the JSON below, then in n8n choose Workflows → Import from clipboard. It has three nodes: Webhook receives WACO events, Code verifies the signature and filters, HTTP Request replies through the WACO API. The example logic: when a customer mentions "price", send a link to the price list.

{
  "name": "WACO → n8n: auto-reply",
  "nodes": [
    { "id": "1", "name": "WACO Webhook", "type": "n8n-nodes-base.webhook", "typeVersion": 2, "position": [0, 0],
      "parameters": { "httpMethod": "POST", "path": "waco", "responseMode": "onReceived", "options": { "rawBody": true } } },
    { "id": "2", "name": "Verify & filter", "type": "n8n-nodes-base.code", "typeVersion": 2, "position": [260, 0],
      "parameters": { "jsCode": "// 1) Verify the WACO signature over the RAW body (not the parsed JSON)\nconst crypto = require('crypto');\nconst SECRET = 'whsec_REPLACE_WITH_YOUR_SECRET';\nconst raw = await this.helpers.getBinaryDataBuffer(0, 'data');\nconst received = String($input.first().json.headers['x-waco-signature'] || '');\nconst computed = 'sha256=' + crypto.createHmac('sha256', SECRET).update(raw).digest('hex');\nif (received.length !== computed.length || !crypto.timingSafeEqual(Buffer.from(received), Buffer.from(computed))) return [];\nconst ev = JSON.parse(raw.toString('utf8'));\n// 2) Incoming messages only (status & echo events are ignored in this example)\nif (ev.event !== 'message.received') return [];\n// 3) De-duplicate: a WACO webhook can be delivered twice -> remember processed ids\nconst st = $getWorkflowStaticData('global');\nst.seen = st.seen || {};\nconst now = Date.now();\nfor (const k of Object.keys(st.seen)) if (now - st.seen[k] > 86400000) delete st.seen[k];\nif (st.seen[ev.pesan.id]) return [];\nst.seen[ev.pesan.id] = now;\n// 4) Your logic: example auto-reply when a customer asks for prices\nconst text = String(ev.pesan.teks || '').toLowerCase();\nif (!/price|harga|how much/.test(text)) return [];\nreturn [{ json: { dari: ev.dari, nama: ev.nama, balasan: 'Hi ' + (ev.nama || '') + ', here is our price list: https://example.com/prices' } }];" } },
    { "id": "3", "name": "Reply via WACO", "type": "n8n-nodes-base.httpRequest", "typeVersion": 4.2, "position": [520, 0],
      "parameters": { "method": "POST", "url": "https://waco.id/api/v1/balas",
        "authentication": "genericCredentialType", "genericAuthType": "httpHeaderAuth",
        "sendBody": true, "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({ nomor: $json.dari, teks: $json.balasan }) }}",
        "options": {} } }
  ],
  "connections": {
    "WACO Webhook": { "main": [[{ "node": "Verify & filter", "type": "main", "index": 0 }]] },
    "Verify & filter": { "main": [[{ "node": "Reply via WACO", "type": "main", "index": 0 }]] }
  }
}

Step 2. Fill in the secret & API key

1. Open the Verify & filter node and replace whsec_REPLACE_WITH_YOUR_SECRET with your webhook secret.
2. Open the Reply via WACO node → Credential → create a new Header Auth: Name Authorization, Value Bearer waco_YOUR_KEY.
3. Activate the workflow, then copy the Production URL from the Webhook node (it ends in /webhook/waco).

Step 3. Register the URL with WACO

On the Developer page, paste the Production URL as your webhook URL and save. Send a chat to your WhatsApp number containing the word "price", within a second or two the reply from n8n arrives, and the run shows up under Executions in n8n.

Three things that keep this flow safe to run forever

• Signature verification. Every WACO POST carries X-WACO-Signature: sha256=…, an HMAC-SHA256 over the raw body. The Code node recomputes it from the raw body (the Raw Body option on the Webhook node) and drops anything that does not match, skip this and anyone who knows your URL can trigger the flow.
• De-duplication. A WACO webhook can be delivered twice (dual delivery for reliability). The Code node remembers processed pesan.id values for 24 hours in workflow static data, so the bot never replies twice.
• Fast acknowledgement. The Webhook node is set to Respond: Immediately, so WACO gets a 200 before your logic runs; redelivery only happens if n8n truly did not answer.

On self-hosted n8n, allow the Code node to use the crypto module by setting the environment variable NODE_FUNCTION_ALLOW_BUILTIN=crypto. On n8n Cloud it is already available.

Common variations

• Log to Google Sheets / Notion / Airtable: replace the HTTP Request node with the destination node; the fields are ev.dari, ev.nama, ev.pesan.teks, ev.waktu.
• Send a template from another system (new order, invoice due): no webhook needed, just an HTTP Request node to POST https://waco.id/api/v1/kirim with body {"nomor":"628…","template":"template_name","isi":["…"]}. Templates are required for the first message outside the 24-hour window; /balas is only for replying to a still-open chat.
• Track delivery: the message.status event carries a pesan_id equal to the message_id returned by /kirim, match them to know delivered/read/failed per message.
• Incoming media: for images/documents, download the file via GET /api/v1/media/{pesan.data.id} with the same API key.

Make and Zapier

Identical pattern: Webhooks → Custom webhook (Make) or Webhooks by Zapier → Catch Hook receives the event; HTTP → Make a request or Webhooks by Zapier → POST calls the WACO API with Authorization: Bearer waco_…. Signature verification uses each platform's code module (Make: Custom JS, Zapier: Code by Zapier) with the same HMAC logic as above.

Frequently asked

Does this need a special plan? No. The API and webhooks are included in every WACO plan; message fees are paid to Meta as usual.

Can it run alongside the team inbox? Yes. Webhooks run side by side: your team keeps replying from the inbox while n8n receives a copy of the same events.

Is there an official WACO node in the n8n catalogue? Not yet, and it is not needed; HTTP Request covers the whole API. The full spec is in the OpenAPI reference.