# Build brief — a focused alternative to Wabery

> **Verdict:** Partly, if you narrow it · **Buildability:** 53/100 · **Category:** Dev Tools
> **Source:** https://www.canitbevibecoded.com/wabery
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from Wabery. Verify current pricing and capabilities before acting.

## Context

**Wabery** — WhatsApp API infrastructure for AI agents, automations, Flows, webhooks, and inboxes. It currently costs $15/mo.

The core loop (send, receive, verify webhooks, retry, inspect conversations) is one-shottable for a single business using Meta's WhatsApp Cloud API. What you cannot one-shot is the reason managed WhatsApp providers exist as products: production messaging infrastructure must stay reliable, secure, monitored, and compliant, while onboarding other businesses requires Meta business verification, app review, and approval for the relevant Tech Provider and Meta Business Partner capabilities. The honest DIY move is to build for your own verified WhatsApp Business Account and phone number; matching Wabery as a multi-tenant provider means operating that infrastructure and completing Meta's approval process.

This brief describes a focused, single-operator replacement for the part of Wabery that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

For one verified business and phone number, send WhatsApp messages, ingest and verify events, retry delivery, forward signed webhooks, and inspect conversations.

- Build the focused developer workflow you use repeatedly, with local configuration.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- Verified business, WhatsApp Business Account, and phone number.
- Always-on HTTPS server.
- PostgreSQL.
- Monitoring and backups.

### Data and integrations

- Meta Developer account and WhatsApp Cloud API access.

Each of these needs a real account, credential, or quota. Set them up before writing feature code.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build me a single-business WhatsApp API gateway to replace Wabery for my own company. Requirements:

- Node 22 + TypeScript + Fastify + PostgreSQL; Docker Compose behind Caddy
  HTTPS on my always-on VPS.
- One Meta WhatsApp Business Account and phone number only. Keep the Cloud API
  access token, app secret, verify token, and phone number ID in .env.
- An authenticated REST API to send text, template, and media messages. Accept
  an Idempotency-Key and return both the local record and Meta message ID.
- Implement Meta webhook verification and verify POST signatures with the app
  secret. Persist each event before responding, deduplicate it, and normalize
  inbound messages, delivery statuses, and errors into PostgreSQL.
- Use pg-boss for outbound jobs with three retries and exponential backoff.
  Failed jobs go to a dead-letter view and can be replayed manually.
- Forward normalized events to one configured webhook, signed with HMAC. Store
  every attempt, response status, and next retry time.
- A small admin inbox behind one ADMIN_TOKEN: conversations, message status,
  failed jobs, webhook health, and a reply box. No public user accounts.
- Add health/readiness endpoints, structured logs, migrations, rate limits,
  daily database backups, and tests for signatures, deduplication, and retries.
- No telemetry beyond calls to Meta. Secrets must never be logged or committed.
- Out of scope: multi-tenant customer onboarding, Embedded Signup, billing,
  Meta Business Partner or Tech Provider status, WhatsApp Flows tooling, hosted
  functions, MCP, and production SLAs. Those require infrastructure and Meta
  review or approval beyond what code can provide.
- README: exact Meta app, WABA, number, webhook, and template setup; business
  verification caveats; deployment, backup restore, and secret rotation.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- Meta Business Partner status and approved Tech Provider onboarding path.
- Turnkey onboarding for multiple customer businesses and phone numbers.
- Managed queues, retries, monitoring, security, and production reliability.
- WhatsApp Flows builder, encryption, and data-exchange hosting.
- Connectors, OAuth flows, and vendor API changes require constant upkeep.
- Reliability at the vendor's scale is an operations problem, not a prompt.

## What you still own after launch

- Secure credentials, rotate secrets, and handle provider rate limits.
- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.

## Risk

**Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost.

Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.

## Prior art

Working open-source software you can read, fork, or borrow from before starting:

- [Meta WhatsApp Cloud API](https://developers.facebook.com/docs/whatsapp/cloud-api) — The official API is the shortest DIY path for a single business that can complete Meta's setup and verification

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/wabery