Connect WhatsApp
Let users message Sandra on WhatsApp — text, images, and voice notes. Full AI conversations from their phone.
Capabilities
| Text conversations | Full AI conversations via WhatsApp messages |
| Image understanding | Users send photos — Sandra uses vision AI to analyze them |
| Voice notes | Users send voice messages — Sandra transcribes and responds |
| Group chats | Sandra participates in groups when mentioned |
| Identity linking | Link WhatsApp number to Sandra account for personalization |
1. Create a Meta app
Sandra AI → connect your Business Account2. Configure a phone number
3. Generate a permanent access token
The temporary token in API Setup expires in 24 hours. For production, create a System User Token:
Sandra Bot with Admin rolewhatsapp_business_messaging, whatsapp_business_management4. Set up the webhook
Sandra receives incoming messages via a webhook from Meta.
https://<your-sandra-url>/api/channels/whatsappsandra-whatsapp-verify-2026)messages webhook field5. Configure Sandra
Option A: Environment variables
WHATSAPP_PHONE_NUMBER_ID=123456789012345
WHATSAPP_ACCESS_TOKEN=EAAxxxxxxx...
WHATSAPP_VERIFY_TOKEN=sandra-whatsapp-verify-2026
WHATSAPP_API_VERSION=v19.0Option B: Admin Portal
6. Verify
linkIdentity linking
Users can link their WhatsApp number to their Sandra account for personalized responses across all channels:
- 1. User messages Sandra on WhatsApp
- 2. Sandra offers to link their account
- 3. User provides their email address
- 4. Sandra sends a verification code to that email
- 5. User confirms the code on WhatsApp → linked!
Troubleshooting
Messages not received
Check that the webhook URL is correct, publicly accessible (HTTPS), and the "messages" field is subscribed.
Messages fail to send
Check the access token. WhatsApp requires users to message first — Sandra can only reply within 24 hours of the last user message.
Slow responses
WhatsApp messages go through Meta’s servers — expect 2–5 second round-trips. Voice notes add 1–3 seconds for transcription.
shieldSecurity notes
- • All webhook payloads verified with HMAC-SHA256 signature validation
- • Message deduplication prevents double-processing
- • Access tokens encrypted at rest
- • Voice notes transcribed in-memory — audio files are not stored
← Connect Zoom
Meeting scheduling.
Connect Instagram →
DM messaging channel.