Set up get.chat by connecting with your channel’s API key, sending a first message, and registering one webhook for each system that needs your WhatsApp events. get.chat is the technology layer behind 360Dialog Inbox, and its Inbox API puts a REST API, a webhook fan-out, and an embeddable inbox UI on top of the official WhatsApp Business API.[1] It is included with the Premium plan at €99 per number per month.[2] This guide runs from your API key to a verified inbound webhook.
Key Takeaways
- You need a WhatsApp number on the 360Dialog Premium plan with the Inbox enabled.
- A first message to a customer who has never written to you must be an approved template, a message format Meta approves in advance.
- Your existing API key is all you need to start, and each system you add later gets its own login for the API.
- Choose which events each webhook receives when you create it, starting with the messages your customers send.
What You Need Before You Start
You need five things in hand before the first API call:
- A 360Dialog account with your WhatsApp number connected and live.
- The Inbox enabled on that number. It ships with the Premium plan; enable it on your channel in the 360Dialog Hub.[3]
- Your Inbox URL, in the form https://YOUR_STACK_NAME.inbox.getchat.360dialog.io/. Open the Inbox from the 360Dialog Hub and copy the address from your browser. Each number has its own Inbox with its own URL.[4]
- Your channel’s API key from the Hub, the secret that identifies your number when you call the WhatsApp API. Generating a new key revokes the old one, so reuse the existing key if another integration depends on it.[5]
- A publicly reachable HTTPS address for each system you want to feed.[6]
All endpoints in this guide live under /api/v1/ on your Inbox address.
If you are connecting your number for the first time, get API access and choose the Premium plan so the Inbox and its API come with it.
How to Authenticate With Your API Key and Service Tokens
The Inbox API accepts your channel’s API key for setup and testing, and one token per service in production. Check the connection by sending the key in the D360-Api-Key header:
curl -H "D360-Api-Key: YOUR_API_KEY" \
https://YOUR_STACK_NAME.inbox.getchat.360dialog.io/api/v1/users/current/The response is the Inbox admin user, which the API key signs you in as. A key from another channel returns 403.
Create a User and Token for Each Service
Each system that talks to the Inbox needs its own user, because webhooks, new-message counts, permissions, and audit logs belong to a user. Create one with the app role, which has API access only:
curl -X POST \
https://YOUR_STACK_NAME.inbox.getchat.360dialog.io/api/v1/users/ \
-H "D360-Api-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"username": "crm-sync", "profile": {"role": "app"}}'The response contains an activation_url, returned only once. Call it to get the service’s token:
curl "ACTIVATION_URL"{"token": "9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b"}Store the token in the service’s secrets, since the activation URL works only once. The service sends it with the Token prefix:
Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4bHow to Send Your First Message
What you can send depends on the customer service window, the period in which WhatsApp lets a business send free-form messages. The window opens when the customer messages you and lasts 24 hours from their last message, or 72 hours for conversations started from a Click-to-WhatsApp ad or a Message button on a Facebook or Instagram Page.[7] Read the expiry from contact.messaging_window_expires_at on the chat, since the duration depends on how the conversation started.[8]
| Conversation state | What you can send |
|---|---|
| The customer has never written to you | Template only |
| The customer wrote within the window | Text, media, interactive, or template |
| The window has expired | Template only |
Sending a template opens a new window.
Send Free-Form Text Inside an Open Window
curl -X POST \
https://YOUR_STACK_NAME.inbox.getchat.360dialog.io/api/v1/messages/ \
-H "Authorization: Token YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"wa_id": "4915112345678", "type": "text", "text": {"body": "Hello from the Inbox API"}}'The wa_id field identifies the recipient: a phone number in international format without the plus sign, or a Business-Scoped User ID (BSUID) when WhatsApp does not share the person’s number. Pass it back exactly as you received it from the chat.
For a first test, open the window yourself: scan the QR code under Open in WhatsApp in the Inbox with your personal phone and send a message.
Send a Template to Open a New Window
Fetch your approved templates from GET /api/v1/templates/, then send one by name in the same format as the WhatsApp API:
{
"wa_id": "4915112345678",
"type": "template",
"template": {
"name": "welcome_message",
"language": {"code": "en"}
}
}Read the Response Codes
Sent, delivered, and read statuses arrive later on your webhook, and error 470 for a recipient without WhatsApp arrives later too.[9]
| Code | Meaning | What to do |
|---|---|---|
| 202 | Accepted and queued for delivery | Wait for status events on your webhook |
| 400 | Something is wrong with the request | Read the reason field |
| 403 | Not signed in, or no permission for this chat | Check the header and the user’s read and write permissions |
| 452 | The recipient is not a valid WhatsApp user | Check the wa_id |
| 453 | Customer service window closed | Send an approved template |
How to Configure Multiple Webhooks on One Number
A webhook is the address where WhatsApp delivers events for your number, and each number has one main webhook. 360Dialog can also attach extra webhook URLs to a number directly, with slower delivery as more are added, and recommends a single webhook for high-volume accounts.[10] The Inbox receives the main webhook and calls the webhook of every service you connect, as an HTTP POST with a JSON body in the standard WhatsApp webhook format.[11]
Webhooks belong to users. The user whose token creates a webhook owns it, and users without admin rights only see their own.[12]
Create an Endpoint
curl -X POST \
https://YOUR_STACK_NAME.inbox.getchat.360dialog.io/api/v1/webhooks/waba/ \
-H "Authorization: Token YOUR_SERVICE_TOKEN" \
-H "Content-Type: application/json" \
-d '{"url": "https://your-backend.example.com/whatsapp", "on_incoming_message": true, "on_outgoing_message": true, "on_assigned": false, "headers": {"Authorization": "Bearer your-own-shared-secret"}}'Set the Event Flags
Each flag switches one event type on or off, so set every flag explicitly when you create a webhook.
| Field | Delivers |
|---|---|
| on_incoming_message | Every message a customer sends to your number |
| on_outgoing_message | Every message sent from the Inbox, through the hosted inbox or the API, for systems that keep complete copies of conversations |
| on_assigned | A chat assigned to this webhook’s user, or a new message in a chat already assigned to them; set it when a bot works its assigned chats |
| on_message_echo | Messages sent from your number through the 360Dialog Messaging API outside the Inbox, as Meta’s message_echoes payload |
| headers | Custom headers sent with every delivery |
Manage Your Endpoints
| Call | What it does |
|---|---|
| GET /api/v1/webhooks/waba/ | Lists webhooks: admins see every user’s, other users see their own |
| POST /api/v1/webhooks/waba/ | Creates one, owned by the token’s user |
| GET /api/v1/webhooks/waba/{id}/ | Inspects one |
| PUT /api/v1/webhooks/waba/{id}/ | Updates one: its address, its events, and its headers |
| DELETE /api/v1/webhooks/waba/{id}/ | Removes one |
| GET /api/v1/webhooks/waba/{id}/test/ | Sends a mock statuses delivery to the target address |
The same settings sit under WABA Webhooks in your inbox settings (WABA stands for WhatsApp Business Account). A WhatsApp sales pipeline can run on its own endpoint, independent of other systems on the number.
If you are planning several systems on one number and want a second opinion on the user and token layout, talk to us before you build it.
How to Secure and Handle Deliveries
Your endpoint is a public address that accepts writes, so authenticate every delivery with one of two methods:
- Custom headers. The headers field is sent with every delivery, so your endpoint can require its own bearer token.
- A shared secret in the address, such as https://your-backend.example.com/whatsapp?auth=SHARED_SECRET, for systems that cannot read custom headers.
Each delivery arrives in the standard WhatsApp webhook format. Trimmed down, an incoming message looks like this:
{
"object": "whatsapp_business_account",
"entry": [{
"changes": [{
"value": {
"contacts": [{"profile": {"name": "Anna"}, "wa_id": "4915112345678", "user_id": "DE.13491208655302741918"}],
"messages": [{"from": "4915112345678", "id": "wamid.ID", "type": "text", "text": {"body": "Hi"}}]
}
}]
}]
}The message is in messages[] and the sender in contacts[]. The BSUID in user_id is always there, even when WhatsApp hides the phone number, so match customers on it first.
Answer 200 quickly and do slow work afterwards. Messages delivered to a webhook with a 200 are marked as received for that webhook’s user, which keeps unread counts in GET /api/v1/chats/ correct.
How to Embed the Inbox in Your Application
The agent inbox is an open-source React app that you can embed in an existing tool with one iframe tag.[13] This suits teams managing WhatsApp conversations as a team inside an internal tool or customer portal.
<iframe
src="https://YOUR_STACK_NAME.inbox.getchat.360dialog.io/?chat_only=1&hide_logo=1"
allow="clipboard-write"
width="420" height="700">
</iframe>Browsers block copy actions inside the frame without allow=”clipboard-write”.
| Parameter | Effect |
|---|---|
| chat_only=1 | Hides the chat list and shows a single conversation |
| hide_logo=1 | Removes the get.chat logo from the loading screen |
| lng=de | Sets the UI language by ISO 639-1 code |
| bg_color=ff0000 | Sets the background color as a hex value without the # sign |
| maximize=1 | Removes the container margins so the inbox fills its frame |
| cf_<filter> | Applies a chat filter on load, using any filter the chats endpoint supports |
Your own logo, page title, favicon, and app manifest require self-hosting the open-source frontend, with variables such as REACT_APP_TITLE, REACT_APP_LOGO_URL, and REACT_APP_FAVICON_URL set at build time.[14]
Testing Checklist: Verifying Your Setup End to End
Run these checks in order, since a failure at any step isolates the problem to that layer.
- Inbox is healthy. GET /api/v1/status/health/ returns a status per internal check.
- Credentials are valid. GET /api/v1/users/current/ returns the admin user for your API key, or the service’s own user for a service token.
- Window is open. Message your business number from a personal WhatsApp account, or scan the QR code under Open in WhatsApp in the Inbox.
- Message sends. POST /api/v1/messages/ with a text body returns 202, and the message arrives on the handset.
- Webhooks are listed. GET /api/v1/webhooks/waba/ shows each endpoint and its on_incoming_message value.
- Endpoint is reachable. GET /api/v1/webhooks/waba/{id}/test/ posts a mock statuses payload with no message in it; your server logs it and returns 200.
- Fan-out works. An inbound message from the test handset reaches every registered endpoint, which is the only step that exercises your flags.
- Inbox shows the chat. Open the Inbox from the 360Dialog Hub and check the conversation.
If the test event never arrives, check HTTPS reachability, a fast 200 response, and any IP allowlist, then check the endpoint under WABA Webhooks in your inbox settings.
With the API key, the service tokens, the webhook flags, and the checklist in place, activate your inbox on the Premium plan to run this setup on your own number.
Frequently Asked Questions
What Authentication Method Does the get.chat API Use?
The Inbox API accepts two credentials. Your channel’s API key, sent in the D360-Api-Key header, signs you in as the Inbox admin and suits setup and testing. In production, each service uses its own app user and token, sent as Authorization: Token YOUR_TOKEN on every call.
Can I Register Several Webhook Endpoints on One WhatsApp Number?
Yes. The Inbox receives the single WhatsApp webhook and delivers each event again to every registered endpoint, each with its own event flags and headers. Webhooks are owned per user, so give each consuming system its own user and token.
Why Is My Webhook Not Receiving Inbound Messages?
Fetch the endpoint with GET /api/v1/webhooks/waba/{id}/ and check that on_incoming_message is true. Then confirm that your endpoint accepts HTTPS POST requests and returns 200 quickly, and send a mock delivery with GET /api/v1/webhooks/waba/{id}/test/ to test the connection.
What Happens if I Send a Message Outside the Customer Service Window?
The API returns 453 with the reason “Customer care messaging window expired.” and nothing is delivered. Send an approved template, which opens a new window.
Does Embedding the Inbox Require Self-Hosting?
Embedding works with your hosted Inbox: point an iframe at the Inbox address and adjust it with query parameters. Self-hosting the open-source frontend is needed only for branding set at build time, such as your own logo, page title, and favicon.
Can One get.chat Instance Serve Several WhatsApp Numbers?
Each number has its own Inbox, with its own address, servers, database, and users. Several numbers mean several Inboxes, and your service connects to each one separately.
Sources
[1] 360Dialog Documentation, “Inbox API.” https://docs.360dialog.com/docs/inbox/inbox-api Accessed September 30, 2026.
[2] 360Dialog, “WhatsApp Business Platform Pricing.” https://360dialog.com/pricing Accessed September 25, 2026.
[3] 360Dialog Documentation, “Quickstart” (Hosted Inbox). https://docs.360dialog.com/docs/inbox/hosted-inbox/quickstart Accessed September 30, 2026.
[4] 360Dialog Documentation, “Quickstart” (Inbox API). https://docs.360dialog.com/docs/inbox/inbox-api/quickstart Accessed September 30, 2026.
[5] 360Dialog Documentation, “Authentication” (Inbox API). https://docs.360dialog.com/docs/inbox/inbox-api/authentication Accessed September 30, 2026.
[6] 360Dialog Documentation, “Making Requests” (Inbox API reference). https://docs.360dialog.com/docs/inbox/inbox-api/reference/making-requests Accessed September 30, 2026.
[7] 360Dialog Documentation, “The Customer Service Window.” https://docs.360dialog.com/docs/inbox/the-customer-service-window Accessed September 30, 2026.
[8] 360Dialog Documentation, “Sending Messages” (Inbox API). https://docs.360dialog.com/docs/inbox/inbox-api/sending-messages Accessed September 30, 2026.
[9] 360Dialog Documentation, “Messages” (Inbox API reference). https://docs.360dialog.com/docs/inbox/inbox-api/api-ref/messages Accessed September 30, 2026.
[10] 360Dialog Partner Documentation, “Set multiple webhooks for Phone Number.” https://docs.360dialog.com/partner/onboarding/webhook-events-and-setup/set-multiple-webhooks-for-phone-number Accessed September 28, 2026.
[11] 360Dialog Documentation, “Receiving Messages” (Inbox API). https://docs.360dialog.com/docs/inbox/inbox-api/receiving-messages Accessed September 30, 2026.
[12] 360Dialog Documentation, “Webhooks” (Inbox API reference). https://docs.360dialog.com/docs/inbox/inbox-api/api-ref/webhooks Accessed September 30, 2026.
[13] get.chat documentation, “Embed and White-Label the Inbox.” https://docs.getchat.360dialog.io/guides/2-embedding-the-inbox/ Accessed September 25, 2026.
[14] get.chat, “get.chat Web App” README. https://github.com/get-chat/web-app Accessed September 25, 2026.
