Let hires message your customers from your business's WhatsApp number, with approved templates and replies, and read what customers send back.
Explore 4 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.
With WhatsApp connected, a hire can send your customers approved message templates (a payment reminder, say), reply to them freely while a conversation is open, see which templates it may use, and read what customers wrote. When a customer writes, the hire can be woken to answer.
It uses Meta's official WhatsApp Business Platform (the Cloud API), with your own business number. Messages go out from that number, in your business's name.
How WhatsApp's rules work
- Templates are messages you write in advance and Meta approves. They're the only way to start a conversation, or to write to someone who hasn't written to you in the last 24 hours. Reminders should be utility templates; anything with an offer or discount counts as marketing.
- The 24-hour window: when a customer writes to you, you can reply with any message for 24 hours. Each new message from them starts the 24 hours again. After that, only templates.
Hires follow both rules. If a hire tries to write freely outside the window, it's told to use a template instead.
1. Set up WhatsApp with Meta
You need a Meta Business account with the WhatsApp Business Platform set up and a phone number added. Then, in Meta:
- A token: open System users in your
Meta Business settings (the form in Roster links there too), add a system user, give it full
control of your app and WhatsApp account, and click Generate token. Choose the permissions
business_management,whatsapp_business_managementandwhatsapp_business_messaging, and no expiry if you're offered the choice. Copy the token. - The IDs: in your app's dashboard, open WhatsApp → API Setup and copy the Phone number ID and the WhatsApp Business Account ID.
- The app secret: in your app's dashboard, open App settings → Basic and copy the App secret.
- Templates: in WhatsApp Manager → Message templates, create the templates hires will use and wait for them to be approved.
To message more than a few customers a day, Meta asks you to verify your business. It also limits new numbers to 250 customers a day at first, and raises the limit as you send.
2. Connect it in Roster
- Open Integrations → Tools → Add a tool, search for WhatsApp and choose it.
- Fill in:
- Access token: the system user's token.
- Phone number ID and WhatsApp Business Account ID.
- Business name: your business's name, like
Bayt Studio. - App secret: from your app's settings.
- Webhook verify token: make up a long random text, and keep it for the next step.
- Click Connect. Roster checks the token on your phone number, and the connection shows Connected as the number's verified business name. If Meta refuses the token (wrong, or expired), Roster says so and saves nothing.
3. Let customers' messages reach Roster
After connecting, the connection shows the address WhatsApp should send messages to, with a Copy address button.
- In your app's dashboard, open WhatsApp → Configuration → Webhook and click Edit.
- Callback URL: paste the address. Verify token: the same text you put in Roster.
- Click Verify and save, then subscribe to the messages field.
From then on, customers' messages arrive in Roster. Roster checks every message really comes from WhatsApp, using the app secret, and ignores anything else.
4. Give hires access
On the hire's Tools tab, click Give access on WhatsApp:
- Read only: it can see the templates and read conversations, and nothing else.
- Read and write: it can also send templates and messages.
- Who it may message: full numbers like
+971501234567, or country codes like+971. Leave it empty to let it message anyone. - Templates: the template names it may send. Leave it empty for every approved template.
Waking a hire when a customer writes
A hire's responsibility can watch WhatsApp: when a customer writes, or a message couldn't be delivered, the hire is woken with what happened, so it can answer while the 24-hour window is open.
First messages to new numbers
A template to a number nobody here has been in touch with (no message either way) waits for a person's approval: the hire asks in the thread with the number, the template and its values, and when the approver says yes, Roster sends exactly that. After that, messages to them don't ask. To change this for a hire, use When it asks first on its Tools tab.
Saying it's an AI assistant
A hire never pretends to be a person, and always says it's AI when asked. If you also want it to say so up front, turn on Say it's an AI assistant in first messages to outsiders under Settings → Workspace (more). Then:
- the first message a hire writes to someone starts with "This is the AI assistant for" and your business name;
- templates can't be changed when they're sent, so the first template to someone has to say it
itself. Make one that does, like
Hello {{1}}, this is the AI assistant for Bayt Studio…. A hire won't send another template as a first message.
Using AI to message your own customers is allowed by Meta. Its rules also ask that customers can reach a person: hires offer to bring in someone from your team when asked.
Tools and permissions reference
This reference is built from the same definitions Roster uses to connect WhatsApp Business and give hires access. It updates with each release.
Authentication and requested permissions
The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.
API key or access token
A system user's token from Meta Business Suite (Business settings → System users → Generate token) with whatsapp_business_messaging and whatsapp_business_management.
When making a key, use these permissions from the connection guide:
- business_management
- whatsapp_business_management
- whatsapp_business_messaging
Connection fields
| Field | What to provide |
|---|---|
Access tokentokenRequired · sealed secret | A system user's token from Meta Business Suite (Business settings → System users → Generate token) with whatsapp_business_messaging and whatsapp_business_management. |
Phone number IDphoneNumberIdRequired | In Meta's app dashboard: WhatsApp → API Setup. Not the phone number itself. |
WhatsApp Business Account IDbusinessAccountIdRequired | On the same page, under the phone number ID. |
Business namebusinessNameRequired | Used when hires say they're your business's AI assistant. Your WhatsApp display name works. Never a made-up person's name. |
App secretappSecretOptional · sealed secret | In Meta's app dashboard: App settings → Basic. Roster checks with it that messages really come from WhatsApp. Needed to receive messages. |
Webhook verify tokenverifyTokenOptional · sealed secret | Any long random text. Paste the same text in Meta's webhook settings. Needed to receive messages. |
Per-hire limits
Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.
| Field | What to provide |
|---|---|
Who it may messagenumbersOptional | Full numbers like +971501234567, or country codes like +971. Leave empty to let it message anyone. |
TemplatestemplatesOptional | Template names it may send. Leave empty for every approved template. |
Actions
4 actions: 2 only read and 2 change something. A read action may still need approval when your workspace or hire is set to ask. A locked approval requirement always applies.
4 of 4 actions. Open an action for its arguments and full input schema.
list_templatesRead only
The approved message templates this hire may send, with their language, category and text. Templates are the only way to message someone outside the 24-hour window; reminders use utility templates.
Approval: Uses your workspace and hire approval settings.
This action takes no arguments.
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {}
}send_templateRead and write
Send an approved template to a customer: the only way to start a conversation, or to write after the 24-hour window. Give the template's values in order ({{1}}, {{2}}…) or by name.
Approval: when it writes to someone outside your team for the first time.
| Argument | Type | Details |
|---|---|---|
toRequired | string | the customer's number with country code, like +971501234567 |
templateRequired | string | the template's name, from list_templates |
languageOptional | string | e.g. en_US or ar; needed only when the template has several |
valuesOptional | string[] | object | the body's values: a list for {{1}}, {{2}}…, or an object for named onesDefault: [] |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"to": {
"type": "string",
"minLength": 5,
"description": "the customer's number with country code, like +971501234567"
},
"template": {
"type": "string",
"minLength": 1,
"description": "the template's name, from list_templates"
},
"language": {
"description": "e.g. en_US or ar; needed only when the template has several",
"type": "string",
"minLength": 2
},
"values": {
"default": [],
"description": "the body's values: a list for {{1}}, {{2}}…, or an object for named ones",
"anyOf": [
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "string"
}
}
]
}
},
"required": [
"to",
"template"
]
}send_messageRead and write
Send a free-form text message. Only allowed within 24 hours of the customer's last message to this number (WhatsApp's customer service window); otherwise use send_template.
Approval: Uses your workspace and hire approval settings.
| Argument | Type | Details |
|---|---|---|
toRequired | string | the customer's number with country code, like +971501234567 |
textRequired | string | See input schema below. |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"to": {
"type": "string",
"minLength": 5,
"description": "the customer's number with country code, like +971501234567"
},
"text": {
"type": "string",
"minLength": 1,
"maxLength": 4096
}
},
"required": [
"to",
"text"
]
}read_messagesRead only
Read the conversation with one customer (oldest first, what they sent and what was sent to them), or without a number, who wrote most recently and whether their 24-hour window is open.
Approval: Uses your workspace and hire approval settings.
| Argument | Type | Details |
|---|---|---|
numberOptional | string | the customer's number; leave out for the latest conversations |
limitOptional | integer | See input schema below.Default: 30 |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"number": {
"description": "the customer's number; leave out for the latest conversations",
"type": "string",
"minLength": 5
},
"limit": {
"default": 30,
"type": "integer",
"minimum": 1,
"maximum": 100
}
}
}Watches and incoming events
- This integration supports a responsibility that watches for changes. The guide above explains what it checks and how to limit it.
- Incoming webhooks are supported. Use the callback address shown on the connection and follow the setup guide.
Limits and troubleshooting
- Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
- Expired or revoked access: reconnect or replace the key on the connection.
- Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
- The action schema describes accepted inputs. It does not grant additional access or bypass approvals.