API Documentation

Pricing is in USD. Base URL is https://api.loginwa.com (also reachable at https://loginwa.com/api). Versioned endpoints live under /api/v1/…; the OTP product endpoints are /api/auth/start & /api/auth/verify.

OTP Endpoints

The WhatsApp OTP product. These endpoints now require a valid API key and an active subscription (rate-limited to 60 requests/min). Note the base path is /api/auth/… (not /api/v1/auth/…).

{
  "session_id": "3bbaaf0b-3c11-44a2-8a7e-4edc426c5fcd",
  "expires_in": 300,
  "debug_code": null
}

{
  "status": "verified",
  "phone_number": "6281234567890",
  "verified_at": "2026-06-01T12:00:00Z"
}

Messages API

Send custom WhatsApp messages beyond OTP.

curl -X POST https://api.loginwa.com/api/v1/messages/send \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"6281234567890","message":"Hello from LoginWA!"}'

{
  "success": true,
  "message_id": "msg_abc123",
  "trace_id": "9f1c2e7a-1b3d-4f5a-9c8e-2a1b3c4d5e6f",
  "device_id": "dev_abc123",
  "phone": "6281234567890",
  "quota_remaining": 4987
}

Code Samples — Send Message

Calling POST /api/v1/messages/send in four languages. Keep your API key on the server side.

curl -X POST https://api.loginwa.com/api/v1/messages/send \
  -H "Authorization: Bearer $LOGINWA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "6281234567890",
    "message": "Hello from LoginWA!"
  }'

$client = new \GuzzleHttp\Client();

$res = $client->post('https://api.loginwa.com/api/v1/messages/send', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('LOGINWA_API_KEY'),
        'Content-Type'  => 'application/json',
    ],
    'json' => [
        'phone'   => '6281234567890',
        'message' => 'Hello from LoginWA!',
    ],
]);

$data = json_decode((string) $res->getBody(), true);
echo $data['message_id'];

const res = await fetch(
  'https://api.loginwa.com/api/v1/messages/send',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.LOGINWA_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      phone: '6281234567890',
      message: 'Hello from LoginWA!',
    }),
  }
);

if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data.message_id);

import os, requests

res = requests.post(
    'https://api.loginwa.com/api/v1/messages/send',
    headers={
        'Authorization': f"Bearer {os.environ['LOGINWA_API_KEY']}",
        'Content-Type': 'application/json',
    },
    json={
        'phone': '6281234567890',
        'message': 'Hello from LoginWA!',
    },
)
res.raise_for_status()
print(res.json()['message_id'])

Devices API

Manage WhatsApp devices connected to your app. Device IDs use the engine_device_id (e.g. dev_abc123). Pairing is asynchronous: creating or refreshing a device returns 202 and you poll GET /api/v1/devices/{id} for the QR token.

// Response 200
{
  "devices": [
    {
      "id": "dev_abc123",
      "label": "My WhatsApp",
      "status": "online",
      "phone_number": "6281234567890",
      "is_online": true,
      "last_seen_at": "2026-06-01T10:00:00+00:00",
      "created_at": "2026-01-15T10:00:00+00:00"
    }
  ],
  "count": 1
}

// Response 202
{
  "device_id": "dev_abc123",
  "engine_device_id": "dev_abc123",
  "label": "My WhatsApp",
  "status": "qr_waiting",
  "qr_code": "2@A1b2C3...",
  "job_id": "job_xyz",
  "qr_status_url": "https://api.loginwa.com/api/v1/devices/dev_abc123",
  "message": "Scan QR code with WhatsApp to connect device"
}

Broadcast API

Send bulk WhatsApp messages to multiple recipients with smart delay, scheduling, and progress tracking. All responses are wrapped in { "success": true, "data": … }.

Broadcast Endpoints

Example: Create & Send Campaign

// 1. Create campaign
POST /api/v1/broadcast/campaigns
{
  "name": "Summer Sale 2026",
  "message": "Hello {name}!\n\nSpecial offer for you:\n- 50% discount\n- Free shipping\n\nClick: https://shop.com/promo",
  "contacts": [
    {"phone": "081234567890", "name": "Budi"},
    {"phone": "081234567891", "name": "Ani", "variables": {"city": "Jakarta"}},
    {"phone": "081234567892", "name": "Citra"}
  ],
  "delay_seconds": 5,
  "media_url": "https://example.com/promo.jpg",
  "media_type": "image"
}

// Response
{
  "success": true,
  "data": {
    "id": "camp_abc123xyz",
    "name": "Summer Sale 2026",
    "status": "draft",
    "total_contacts": 3,
    "estimated_duration": "15 seconds"
  }
}

// 2. Start sending
POST /api/v1/broadcast/campaigns/camp_abc123xyz/send

// 3. Check progress
GET /api/v1/broadcast/campaigns/camp_abc123xyz
{
  "success": true,
  "data": {
    "id": "camp_abc123xyz",
    "status": "sending",
    "progress": {
      "total": 3,
      "sent": 2,
      "delivered": 1,
      "failed": 0,
      "pending": 1,
      "percentage": 66.7
    }
  }
}

Webhooks API

Configure webhooks to receive real-time events (incoming messages, delivery status, device and OTP events). Each app may register up to 5 webhooks. The signing secret is shown only once at creation and via regenerate-secret.

{
  "event": "message.incoming",
  "timestamp": "2026-06-01T12:00:00+00:00",
  "data": {
    "message_id": "msg_abc123",
    "from": "6281234567890",
    "body": "Hello!",
    "device_id": "dev_xyz"
  }
}

Webhook Endpoints

Verifying Webhook Signatures

Each delivery includes a signature in the X-LoginWA-Signature header (HMAC-SHA256 of the raw request body). Verify it to ensure authenticity:

// PHP/Laravel example
$signature = $request->header('X-LoginWA-Signature');
$payload   = $request->getContent();
$secret    = 'your_webhook_secret';

$expected = hash_hmac('sha256', $payload, $secret);

if (! hash_equals($expected, (string) $signature)) {
    abort(403, 'Invalid signature');
}

IP Whitelist API

Restrict an API key to specific source IP addresses. When restriction is enabled, requests from non-whitelisted IPs are rejected with 403 ip_not_allowed. These endpoints are exempt from the IP check so you can always manage your list.

Auto-Reply & Chatbot

Automatic replies and chatbot flows are configured per app in the Dashboard — there is no separate API to manage them. When an inbound message arrives, LoginWA evaluates your rules and may reply automatically, then still delivers the message.incoming event to your webhooks so your own logic can run too.

Billing & QRIS

Pricing is in USD. Plans and quotas are managed in the Dashboard, not via the API. Payments — including QRIS for Indonesian customers and card/PayPal globally — are handled entirely in the billing UI; there is no public billing API. An inactive, suspended, or past-due subscription causes API requests to return 402 subscription_suspended.

SDKs & Downloads

OTP Code Examples

Sending an OTP via POST /api/auth/start. Verify with POST /api/auth/verify using the returned session_id.

$client = new \GuzzleHttp\Client();

// Send OTP
$res = $client->post('https://api.loginwa.com/api/auth/start', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('LOGINWA_API_KEY'),
        'Content-Type' => 'application/json',
    ],
    'json' => [
        'phone' => '6281234567890',
        'otp_length' => 6,
    ],
]);

$data = json_decode((string) $res->getBody(), true);
$sessionId = $data['session_id'];

const BASE_URL = 'https://api.loginwa.com/api';
const API_KEY = process.env.LOGINWA_API_KEY;

async function sendOtp(phone) {
    const res = await fetch(`${BASE_URL}/auth/start`, {
        method: 'POST',
        headers: {
            'Authorization': `Bearer ${API_KEY}`,
            'Content-Type': 'application/json',
        },
        body: JSON.stringify({ phone }),
    });

    if (!res.ok) throw new Error('Failed to send OTP');
    return res.json();
}

import requests
import os

BASE_URL = 'https://api.loginwa.com/api'
API_KEY = os.environ.get('LOGINWA_API_KEY')

def send_otp(phone):
    res = requests.post(
        f'{BASE_URL}/auth/start',
        headers={
            'Authorization': f'Bearer {API_KEY}',
            'Content-Type': 'application/json',
        },
        json={'phone': phone}
    )
    res.raise_for_status()
    return res.json()

# Send OTP
curl -X POST https://api.loginwa.com/api/auth/start \
  -H "Authorization: Bearer $LOGINWA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"6281234567890"}'

# Verify OTP
curl -X POST https://api.loginwa.com/api/auth/verify \
  -H "Authorization: Bearer $LOGINWA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"session_id":"xxx","otp_code":"123456"}'

Pricing Plans

Start free, then scale as you grow. Prices are in USD. All plans include full API access, Widget, SDK, Dashboard, Webhooks, and unlimited projects.

Need Help?

Having trouble with integration? We're here to help.