WhatIsUp.dev
Get started

WhatIsUp.dev

A lightweight, developer-first WhatsApp Gateway. Spin up a WhatsApp instance via REST, send messages, receive events as signed webhooks. No Twilio markup, no Meta business-verification ladder, no SDK that hides the wire format.

Why this exists

Every other WhatsApp gateway is either:

  • A reseller of the official Cloud API (slow, expensive per message, requires a verified Meta business profile and a real phone number you don't own); or
  • A Baileys wrapper packaged as a black-box SaaS that breaks the moment WhatsApp changes anything.

WhatIsUp.dev sits in between: an opinionated wrapper around Baileys (the open-source WhatsApp Web client library) with the operational pieces a developer SaaS needs — typed contracts, signed webhooks with retries, Stripe-style API keys, an instance lifecycle FSM, and an SDK story that's just fetch. You bring your own WhatsApp number, you scan a QR once, you ship.

What you get

  • REST API — instances, messages, webhook endpoints, API keys. JSON in, JSON out.
  • Signed webhooks — X-WhatIsUp-Signature: t=<ts>,v1=<hmac>, verified the same way Stripe does.
  • Realtime SSE stream — /v1/events for QR codes and instance state changes without polling.
  • Single-binary deploy — Postgres, Redis, one Node process. Run on Railway, Fly, Hetzner, your Mac.
  • Open contracts — every request, response, and webhook payload is a Zod schema in @whatisup/contracts. The same types your client gets are the ones the gateway validates against.

What you don't get (yet)

  • Official Cloud API support — this is a Web-protocol implementation. WhatsApp can change it, and occasionally does. We track Baileys upstream.
  • Multi-region — single primary, single Redis. Fine for v1.
  • Inbound media object storage — we cache attachments in memory and proxy them via signed URLs. No S3 yet. See Concepts → Webhooks.

This project is for developer-tier use. Don't use it for compliance-bound workflows (healthcare, regulated finance, anything that requires the official Cloud API's business-account guarantees). It's a wrapper around an unofficial protocol.

Where to next