Blog · WebJi® India

Host a WhatsApp Bot on a VPS (Legal, Official API)

Quick answer

Yes, a WhatsApp bot runs 24/7 on a VPS using Meta's official Cloud API: your code sits on the server, Meta POSTs incoming messages to its HTTPS webhook, and PM2 keeps the process alive. A 1–2 GB RAM VPS is enough for a webhook bot. Unofficial libraries that automate a personal number risk a ban.

For Indian businesses and developers building an order-status, booking or support bot on WhatsApp and hosting the backend on their own VPS.

✓ In business since 2005

✓ INR + GST billing

✓ 24/7 Email Support — avg reply < 60 min

Get Started View Plans

GuideWebJi®
knowledge

Read time: 5 min
Sections: 8
Updated: 14 Nov 2026
Written by: WebJi® team

Last editorial update: 14 November 2026.

How does a WhatsApp bot on a VPS work?

A WhatsApp bot has three parts: your bot code on the VPS, Meta's WhatsApp Business Cloud API as the transport, and an HTTPS webhook URL where Meta delivers every incoming message. When a customer writes to your number, Meta POSTs a JSON event to your webhook; your code decides the reply and sends it back through the Cloud API.

The VPS is needed because of that webhook. It must be reachable on a public HTTPS address at all hours, answer quickly, and keep running through reboots and deploys. A laptop sleeps, and shared hosting rarely allows a long-running Node or Python process, while even a small VPS handles all three.

Customer sends "Order status 4521" to your business number.
Meta POSTs the message to https://bot.example.in/webhook.
Your code checks the signature, looks up order 4521 in your database and builds a reply.
Your code calls the Cloud API /messages endpoint; Meta delivers the reply on WhatsApp.

Official Cloud API vs unofficial WhatsApp libraries

For any business or customer-facing bot, use Meta's Cloud API; libraries such as Baileys or whatsapp-web.js automate a personal account as a linked device, which breaks WhatsApp's terms and puts the number at risk of a ban.

Cloud API compared with unofficial WhatsApp automation libraries
Attribute	WhatsApp Business Cloud API	Baileys / whatsapp-web.js
Status	Official, hosted by Meta	Unofficial, reverse-engineered
Number	Business number in a WhatsApp Business Account	Personal or WhatsApp Business app number
Messaging customers first	Only with approved templates and opt-in	Technically possible, but triggers bans
Cost	Meta per-message rates plus your VPS	VPS only, plus the risk to the number
VPS load	Light: HTTP webhooks	Heavier: often a headless browser, 4 GB RAM or more

What does the WhatsApp Cloud API charge in 2026?

Since 1 July 2025 Meta charges per delivered message, by category and by the recipient's country, and messages from customers to you are free. Rates differ for marketing, utility, authentication and service messages; Meta publishes an INR rate card and may update rates only on the first day of each quarter.

Customer service window: each customer message opens a 24-hour window in which you can send free-form (non-template) replies. Outside it, you can only send approved templates.
Service replies: from 1 October 2026, each business number gets 1,000 free service messages a month; service messages after that are charged.
Utility templates inside the window: charged again from 1 October 2026, after a period of being free.
Click-to-WhatsApp ads: conversations that start from such an ad open a free entry-point window of up to 7 days.
India billing: Meta introduced INR billing for India-based businesses on 1 January 2026 and asks eligible accounts to move to INR by 31 December 2026.

Meta pricing rules summarised from its WhatsApp Business Platform pricing documentation, read 14 November 2026. Check Meta's current rate card before budgeting.

What VPS does a WhatsApp bot need?

A Cloud API bot that only answers webhooks runs comfortably in 1–2 GB of RAM; add memory when the same server also runs a database, a dashboard, media processing or an AI model.

Public IPv4 address with ports 80 and 443 open.
Ubuntu 24.04 LTS (or 22.04) with Node.js 22 or 24 LTS, or Python 3.12.
A domain or subdomain such as bot.example.in with a free Let's Encrypt certificate.
PM2 (Node) or systemd (Python) to keep the process alive.
Backups of code, database and the .env file that holds the token and app secret.

WebJi® VPS plans are quoted in INR before payment, with 18% GST on the invoice; the sample VPS-Start configuration is 2 vCPU, 4 GB RAM and 60 GB NVMe.

Step 1: create the Meta app and get credentials

Everything on Meta's side happens in Meta for Developers and Business Manager before your server is involved: you need a phone number ID, a permanent access token, the app secret and a verify token of your choosing.

At developers.facebook.com, create an app of the Business type and add the WhatsApp product.
Meta gives you a test number that can message up to five verified recipient numbers.
Connect your WhatsApp Business Account and complete business verification in Meta Business Manager for production use.
Add and verify your production phone number.
Create a System User, grant it the WhatsApp permissions and generate a permanent token. Note the phone number ID and the app secret.

Step 2: write and deploy the webhook on the VPS

The webhook must answer Meta's GET verification by echoing hub.challenge, and should verify the X-Hub-Signature-256 header on every POST before trusting the payload. A minimal Express handler:

const express = require('express');
const crypto = require('crypto');
const app = express();
app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf; } }));

app.get('/webhook', (req, res) => {
  if (req.query['hub.mode'] === 'subscribe' &&
      req.query['hub.verify_token'] === process.env.VERIFY_TOKEN) {
    return res.status(200).send(req.query['hub.challenge']);
  }
  res.sendStatus(403);
});

app.post('/webhook', (req, res) => {
  const sig = req.get('x-hub-signature-256') || '';
  const expected = 'sha256=' + crypto.createHmac('sha256', process.env.APP_SECRET)
    .update(req.rawBody).digest('hex');
  if (sig.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.sendStatus(401);
  }
  res.sendStatus(200);   // acknowledge fast, then process
  const msg = req.body.entry?.[0]?.changes?.[0]?.value?.messages?.[0];
  if (msg) console.log(msg.from, msg.text?.body);
});

app.listen(3000, '127.0.0.1');

npm install express
pm2 start index.js --name wa-bot
pm2 startup && pm2 save
sudo certbot --nginx -d bot.example.in

Put Nginx in front as a reverse proxy to 127.0.0.1:3000, the same pattern used in deploying Next.js on a VPS; certificate steps are in Certbot SSL on Nginx.

Step 3: connect the webhook, send a reply and go live

Register the callback URL and verify token in the app's WhatsApp configuration, subscribe to the messages field, and test a reply from the test number before switching to production.

curl -X POST "https://graph.facebook.com/vXX.X/PHONE_NUMBER_ID/messages" \
  -H "Authorization: Bearer $WA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"messaging_product":"whatsapp","to":"919812345678","type":"text","text":{"body":"Your order 4521 has shipped."}}'

API version: replace vXX.X with the Graph API version shown in your app dashboard.
Templates: create and submit templates (marketing, utility or authentication) for any message you send outside the 24-hour window.
Opt-in: only message people who have agreed to hear from you on WhatsApp.
Production switch: swap the phone number ID and token in .env, then pm2 restart wa-bot.

If you would rather have the server set up and maintained for you, WebJi® WhatsApp bot hosting covers the VPS, SSL and deployment; email support@webji.services with your stack for a quote. A similar setup for Telegram is in hosting a Telegram bot on a VPS.

FAQ

Frequently asked questions

Can I use my existing WhatsApp Business app number for the Cloud API?

A number registered on the Cloud API is managed through the API. Meta offers ways to bring an existing WhatsApp Business app number onto the platform, but check the current migration options in your Business Manager first, and keep chat backups before you move it.

Why does Meta keep retrying my webhook?

Meta treats any response other than a quick HTTP 200 as a failure and retries. Acknowledge the request immediately, then do slow work such as database lookups or AI calls afterwards, ideally through a queue, so the endpoint never times out.

Can I build a WhatsApp bot without coding?

Partly. No-code platforms and workflow tools such as n8n sit on top of the Cloud API for menus and auto-replies. Custom logic, database lookups and integrations still need code; installing n8n on a VPS is a middle path.

Does my business need to be verified to use the Cloud API?

You can build and test with Meta's test number first. For production use and higher messaging limits, Meta asks for business verification with documents that prove the legal name and address. The accepted documents are listed on the verification screen in Business Manager and are set by Meta.

Checked 14 November 2026 against Meta's WhatsApp Business Platform documentation · Reviewed by the WebJi® team, Jaipur.

WebJi® since 2005

Ready to get started with WebJi®?

Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.

Talk to an Expert Compare Plans