WhatsApp QR — Premium Messaging API Platform

Secure by default

Send WhatsApp via API — never expose secrets in the browser.

Use API key + secret from your server only. Base URL: https://cloud.messagerocket.in/v1

• Identify sender with API key + WhatsApp no
• Plain text, image, PDF, video (+ caption on media)
• Connected / disconnected status per number
• Reload QR when session drops — scan again
• Webhooks for delivery status updates

Required headers

x-api-key: YOUR_API_KEY
x-api-secret: YOUR_API_SECRET
Content-Type: application/json

Create keys in Developer Console → API Keys. Keep x-api-secret only on your backend.

How routing works

One API user → many WhatsApp numbers → many websites

An API user can add up to their plan limit of WhatsApp numbers (each scanned once in Devices). When you add a number, that value is the WhatsApp number identity — not a free-text nickname. Each of your websites passes the same API key, plus the WhatsApp number that website should send from. We map API key + WhatsApp number → that exact linked line.

1. Add numbers

Console → Devices → enter WhatsApp no (e.g. 9198…) → scan QR until Connected.

2. Same API key

Create one API key for the user. Every website uses that key + secret on the server.

3. Per-website number

Site A sends whatsappNo for line 1, Site B for line 2, … — message leaves that WhatsApp only.

# Website A → send from WhatsApp 919111111111
x-api-key: USER_KEY
x-api-secret: USER_SECRET

{ "whatsappNo": "919111111111", "to": "919999999999", "text": "From site A" }

# Website B → send from WhatsApp 919222222222 (same key, different number)
{ "whatsappNo": "919222222222", "to": "919999999999", "text": "From site B" }

Authentication & keys

POST/v1/auth/login

Panel login (JWT)

Used by Console / Admin UI. For server integrations prefer API keys.

Body

{
  "email": "user@novalink.local",
  "password": "User@123456"
}

POST/v1/apikeys

Create API key

Returns key + secret once. Store secret securely — it is not shown again.

Body

{
  "name": "Production server"
}

Note: Requires JWT (logged-in Console user).

Send messages

When you have multiple WhatsApp numbers, every send needs API key headers + whatsappNo (sender).

Multi-number identity

x-api-key picks the API user. whatsappNo picks which of that user’s linked numbers sends the message. Both are required for reliable routing.

POST/v1/messages/text

Plain text

Send a normal WhatsApp text message.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "text": "Hello from WhatsApp QR"
}

Note: whatsappNo = your linked sender number. to = recipient.

POST/v1/messages/image

Image

Send an image from a public HTTPS URL.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "mediaUrl": "https://example.com/photo.jpg"
}

POST/v1/messages/image-caption

Image + text caption

Image with caption text below / on the media.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "mediaUrl": "https://example.com/photo.jpg",
  "caption": "Today’s offer — limited stock"
}

POST/v1/messages/pdf

PDF document

Send a PDF file.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "mediaUrl": "https://example.com/invoice.pdf"
}

POST/v1/messages/pdf-caption

PDF + text caption

PDF with accompanying caption text.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "mediaUrl": "https://example.com/invoice.pdf",
  "caption": "Your invoice for March"
}

POST/v1/messages/video

Video

Send a video from a public HTTPS URL.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "mediaUrl": "https://example.com/clip.mp4"
}

POST/v1/messages/video-caption

Video + text caption

Video with caption text.

Body

{
  "whatsappNo": "919876543210",
  "to": "919123456789",
  "mediaUrl": "https://example.com/clip.mp4",
  "caption": "Watch this quick demo"
}

GET/v1/messages/status?messageId=MESSAGE_UUID

Message status

Check if a message is queued, sent, failed, etc.

POST/v1/messages/check-number

Check WhatsApp number

Verify whether a number exists on WhatsApp (uses a connected device).

Body

{
  "to": "919876543210"
}

Image ± caption

PDF ± caption

Video ± caption

Devices, health & QR reload

Add each WhatsApp number, connect with QR, then send with API key + whatsappNo.

POST/v1/devices

Add WhatsApp number

Registers a sender line. Use the same whatsappNo later when sending messages.

Body

{
  "whatsappNo": "919876543210"
}

GET/v1/devices

List WhatsApp numbers

See all your numbers and high-level status (includes whatsappNo).

GET/v1/devices/:id/status

Device health / status

Connected, Disconnected, QR Waiting, Logged Out — use this before sending.

Note: Also: GET /v1/devices/status?deviceId=UUID

POST/v1/devices/:id/connect

Connect / generate QR

Starts Baileys session and returns a QR (data URL). Scan with WhatsApp → Linked devices.

POST/v1/devices/:id/reconnect

Reconnect

Restart session when link is flaky.

POST/v1/devices/:id/disconnect

Disconnect

Stop the live session without deleting the device record.

GET/v1/qr/generate?deviceId=DEVICE_UUID

QR generate API

Same as connect — get a fresh QR for scanning.

GET/v1/qr/status?deviceId=DEVICE_UUID

QR / session status

Poll whether QR is pending or already scanned / connected.

POST/v1/qr/refresh

Reload QR (when disconnected)

If the device is disconnected or QR expired, call this, show the new QR, and scan again.

Body

{
  "deviceId": "DEVICE_UUID"
}

Note: UI: Console / Admin → Devices → open device → Reload QR / Connect.

Disconnected → reload → scan again

GET …/devices/:id/status → see Disconnected / Logged Out
POST …/qr/refresh (or …/connect)
Show returned QR image → phone scan → status becomes Connected

Webhooks

Receive message status updates on your HTTPS endpoint.

POST/v1/webhooks

Register webhook

We POST JSON events (e.g. message.status) to your URL.

Body

{
  "name": "My server",
  "url": "https://your-server.com/hooks/whatsapp",
  "events": ["message.status"]
}

Note: Requires JWT from Console. Use HTTPS in production.

GET/v1/webhooks

List webhooks

See registered callback URLs.

DELETE/v1/webhooks/:id

Delete webhook

Remove a callback registration.

API health

Quick liveness check for your integration monitors.

GET/v1/health

Health check

No auth required. Returns server / database readiness.

Device status = connection healthQR APIs = re-link when offline