We are sunsetting On-Premises API. Refer to our On-Premises API Sunset document for details, and to learn how to migrate to our next-generation Cloud API.
This document provides information for setting up your network and debugging potential problems.
The WhatsApp Business API client has certain network requirements for connecting to the WhatsApp servers. If your business cannot do the below, we unfortunately cannot support your WhatsApp integration.
We understand that different businesses have different network configurations and security concerns Contact Direct Support if this document is not sufficient for your setup because of any special connectivity or security requirements you may have.
The WhatsApp Business API client requires a long-lived TCP connection. Occasional requests will be made so the connection does not stay idle. However, you will have to ensure that your firewall, router, security, etc. do not terminate the long-lived TCP connections.
There are two ports used for outgoing traffic:
5222
443
They are not listening or used for incoming traffic. Your business's firewall can still protect from incoming traffic as normal.
The default port for the WhatsApp Business API client is 5222
. If that port is not available, the application will fallback to port 443
. Port 443
needs to be opened for HTTPS
at the minimum for application registration and restarts. You can leave port 5222
closed and have port 443
open, but you cannot open port 5222
and not port 443
.
It is recommended that you open both ports and allow all outgoing traffic.
The WhatsApp Business API client uses two types of protocols:
chatd
HTTPS
The WhatsApp proprietary chat protocol, called chatd
, is used to send the encrypted messages and information to and from the WhatsApp servers. Because it is proprietary, we ask that the port you open be on an allow list for all outgoing traffic. Some firewalls and proxies terminate non-SSL connections, which will interfere with the application's ability to connect to WhatsApp servers.
WhatsApp uses HTTPS
during registration and it is necessary for restarts. We do not recommend blocking HTTPS
after registration because you never know when you will have to re-register or restart your application.
WhatsApp uses a wide range of IP addresses for its servers. You can try to allow all of the IP addresses. However, it is best to just allow all outgoing traffic and connections from the above ports.
WhatsApp server IP addresses and ranges (.zip file)This list might change often. It is therefore recommended you allow all outgoing traffic from port 5222
or 443
, to avoid having to update this allow list in your network each time it changes.
You can add the WhatsApp servers to your allow list by hostname rather than IP address.
The WhatsApp server hostnames that the WhatsApp Business API client requires connectivity to are:
.*.cdn.whatsapp.net
g.whatsapp.net
graph.facebook.com
graph.whatsapp.com
media-.*.cdn.whatsapp.net
media..*.fna.whatsapp.net
mmg.whatsapp.net
pps.whatsapp.net
static.whatsapp.net
v.whatsapp.net
You will also need to allow access to our repository in JFrog where we host the Docker container images in order to download them.
You must use hostnames in your allow list for JFrog as IP addresses cannot be provided.
The necessary JFrog hostnames are:
docker.whatsapp.biz
dl.bintray.com
akamai.bintray.com
Depending on your firewall and how it functions, adding the hostnames to an allow list may not work and you will need to add all the IP addresses to an allow list instead.
Examples of firewall behavior that will not work with just the hostnames on an allow list are:
HTTP
/HTTPS
handshake.In the event that your firewall exhibits one of these behaviors please proceed to use the IP addresses in an allow list.
Configure network proxies by setting the following environmental variables to the proxy you are using, then pass them to the Coreapp:
http_proxy
https_proxy
The WADebug tool can help quickly check whether the Coreapp container has access to all the required WhatsApp servers. With WADebug installed, simply run:
wadebug partial check_network