Can Wabery be vibe coded?
WhatsApp API infrastructure for AI agents, automations, Flows, webhooks, and inboxes
The core loop (send, receive, verify webhooks, retry, inspect conversations) is one-shottable for a single business using Meta's WhatsApp Cloud API. What you cannot one-shot is the reason managed WhatsApp providers exist as products: production messaging infrastructure must stay reliable, secure, monitored, and compliant, while onboarding other businesses requires Meta business verification, app review, and approval for the relevant Tech Provider and Meta Business Partner capabilities. The honest DIY move is to build for your own verified WhatsApp Business Account and phone number; matching Wabery as a multi-tenant provider means operating that infrastructure and completing Meta's approval process.
Jump to the build brief ↓Checked Jul 2026
What you pay today, before any DIY hosting
high editorial confidence
Buildability by layer
Screens, forms, and focused interactions
The repeatable job the product performs
Availability and legality of required data
Uptime, queues, support, and maintenance
Security, compliance, and user confidence
The achievable core
- For one verified business and phone number, send WhatsApp messages, ingest and verify events, retry delivery, forward signed webhooks, and inspect conversations.
- Build the focused developer workflow you use repeatedly, with local configuration.
- A responsive interface with real empty, loading, success, and error states.
The parts a prompt cannot buy
- Meta Business Partner status and approved Tech Provider onboarding path
- turnkey onboarding for multiple customer businesses and phone numbers
- managed queues, retries, monitoring, security, and production reliability
- WhatsApp Flows builder, encryption, and data-exchange hosting
- Connectors, OAuth flows, and vendor API changes require constant upkeep.
- Reliability at the vendor's scale is an operations problem, not a prompt.
Why people still pay
The REST endpoints are the easy part. Wabery packages Meta onboarding, secure multi-tenant infrastructure, durable event delivery, Flows plumbing, monitoring, and ongoing API and policy changes into a service that is ready for production. A DIY gateway is reasonable for one business; becoming an approved and reliable provider for other businesses is a company, not a contained effort project.
Connectors, OAuth flows, and vendor API changes require constant upkeep.
Reliability at the vendor's scale is an operations problem, not a prompt.
The brief
Context, requirements, acceptance criteria, non-goals, and the full production standard — as Markdown, ready for any coding agent.
Build brief — a focused alternative to Wabery
Context
**Wabery** — WhatsApp API infrastructure for AI agents, automations, Flows, webhooks, and inboxes. It currently costs $15/mo.
The core loop (send, receive, verify webhooks, retry, inspect conversations) is one-shottable for a single business using Meta's WhatsApp Cloud API. What you cannot one-shot is the reason managed WhatsApp providers exist as products: production messaging infrastructure must stay reliable, secure, monitored, and compliant, while onboarding other businesses requires Meta business verification, app review, and approval for the relevant Tech Provider and Meta Business Partner capabilities. The honest DIY move is to build for your own verified WhatsApp Business Account and phone number; matching Wabery as a multi-tenant provider means operating that infrastructure and completing Meta's approval process.
This brief describes a focused, single-operator replacement for the part of Wabery that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.
What you are building
For one verified business and phone number, send WhatsApp messages, ingest and verify events, retry delivery, forward signed webhooks, and inspect conversations.
Build the focused developer workflow you use repeatedly, with local configuration.
A responsive interface with real empty, loading, success, and error states.
Requirements
Functional
Verified business, WhatsApp Business Account, and phone number.
Always-on HTTPS server.
PostgreSQL.
Monitoring and backups.
Data and integrations
Meta Developer account and WhatsApp Cloud API access.
Each of these needs a real account, credential, or quota. Set them up before writing feature code.
Non-functional
Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
Security: server-side secrets, validated input, and no credentials in the client bundle.
Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
Portability: the operator can export their data and leave without losing it.
Implementation brief
Build me a single-business WhatsApp API gateway to replace Wabery for my own company. Requirements:
Node 22 + TypeScript + Fastify + PostgreSQL; Docker Compose behind Caddy
HTTPS on my always-on VPS.
One Meta WhatsApp Business Account and phone number only. Keep the Cloud API
access token, app secret, verify token, and phone number ID in .env.
An authenticated REST API to send text, template, and media messages. Accept
an Idempotency-Key and return both the local record and Meta message ID.
Implement Meta webhook verification and verify POST signatures with the app
secret. Persist each event before responding, deduplicate it, and normalize
inbound messages, delivery statuses, and errors into PostgreSQL.
Use pg-boss for outbound jobs with three retries and exponential backoff.
Failed jobs go to a dead-letter view and can be replayed manually.
Forward normalized events to one configured webhook, signed with HMAC. Store
every attempt, response status, and next retry time.
A small admin inbox behind one ADMIN_TOKEN: conversations, message status,
failed jobs, webhook health, and a reply box. No public user accounts.
Add health/readiness endpoints, structured logs, migrations, rate limits,
daily database backups, and tests for signatures, deduplication, and retries.
No telemetry beyond calls to Meta. Secrets must never be logged or committed.
Out of scope: multi-tenant customer onboarding, Embedded Signup, billing,
Meta Business Partner or Tech Provider status, WhatsApp Flows tooling, hosted
functions, MCP, and production SLAs. Those require infrastructure and Meta
review or approval beyond what code can provide.
README: exact Meta app, WABA, number, webhook, and template setup; business
verification caveats; deployment, backup restore, and secret rotation.
Delivery standard
Inspect the repository first, then write a short implementation plan before writing code.
Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
Add structured logs around every external call and return actionable errors without leaking sensitive details.
Write unit tests for the core logic and one automated test of the main user journey.
Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.
Acceptance criteria
A clean install starts the app using only the README and .env.example.
The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
Tests, type checking, linting, and a production build all pass with no ignored failures.
No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.
Non-goals
Do not build these, and do not claim to have replaced them:
Meta Business Partner status and approved Tech Provider onboarding path.
Turnkey onboarding for multiple customer businesses and phone numbers.
Managed queues, retries, monitoring, security, and production reliability.
WhatsApp Flows builder, encryption, and data-exchange hosting.
Connectors, OAuth flows, and vendor API changes require constant upkeep.
Reliability at the vendor's scale is an operations problem, not a prompt.
What you still own after launch
Secure credentials, rotate secrets, and handle provider rate limits.
Run migrations, backups, restores, and dependency updates.
Test the critical journey after every model, API, or hosting change.
Monitor failures and fix the edge cases a first prompt will miss.
Maintain every third-party integration as APIs and OAuth rules change.
Risk
**Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost.
Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.
Prior art
Working open-source software you can read, fork, or borrow from before starting:
[Meta WhatsApp Cloud API](https://developers.facebook.com/docs/whatsapp/cloud-api) — The official API is the shortest DIY path for a single business that can complete Meta's setup and verification
Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/wabery
You still own the product
- Secure credentials, rotate secrets, and handle provider rate limits.
- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.
Open-source prior art
Before you start
Can Wabery be vibe coded?
Partly, if you narrow it. The core loop (send, receive, verify webhooks, retry, inspect conversations) is one-shottable for a single business using Meta's WhatsApp Cloud API. What you cannot one-shot is the reason managed WhatsApp providers exist as products: production messaging infrastructure must stay reliable, secure, monitored, and compliant, while onboarding other businesses requires Meta business verification, app review, and approval for the relevant Tech Provider and Meta Business Partner capabilities. The honest DIY move is to build for your own verified WhatsApp Business Account and phone number; matching Wabery as a multi-tenant provider means operating that infrastructure and completing Meta's approval process.
What can an AI coding agent reproduce from Wabery?
For one verified business and phone number, send WhatsApp messages, ingest and verify events, retry delivery, forward signed webhooks, and inspect conversations. Build the focused developer workflow you use repeatedly, with local configuration. A responsive interface with real empty, loading, success, and error states.
What will a DIY Wabery replacement still be missing?
Meta Business Partner status and approved Tech Provider onboarding path; turnkey onboarding for multiple customer businesses and phone numbers; managed queues, retries, monitoring, security, and production reliability; WhatsApp Flows builder, encryption, and data-exchange hosting; Connectors, OAuth flows, and vendor API changes require constant upkeep.; Reliability at the vendor's scale is an operations problem, not a prompt.
What do I still own after building a Wabery alternative?
Secure credentials, rotate secrets, and handle provider rate limits. Run migrations, backups, restores, and dependency updates. Test the critical journey after every model, API, or hosting change. Monitor failures and fix the edge cases a first prompt will miss. Maintain every third-party integration as APIs and OAuth rules change.