The MCP server

MCP is how an AI app uses outside tools. Connect Claude, ChatGPT, Codex or any MCP client to whatsapi, and it can send messages, read chats and manage your numbers. Every tool comes from the same definition as its REST version, so you get the same validation, the same quota and the same errors.

Claude Code and Codex: install the plugin

The whatsapi plugin connects your agent to whatsapi. There's no key to copy.

Claude Code

claude plugin marketplace add owe-br/plugins
claude plugin install whatsapi@owe-br

Then type /mcp, pick whatsapi and choose Authenticate.

Codex

codex plugin marketplace add owe-br/plugins
codex plugin add whatsapi@owe-br
codex mcp login whatsapi

The last line signs you in. It needs Codex 0.147 or later: older versions fail with "missing required issuer". To update, run npm install -g @openai/codex@latest.

Either way, your browser opens whatsapi. Sign in and press Connect. That makes an API key named after the app, listed under API keys in the dashboard. To disconnect the app, revoke that key.

See the plugin on GitHub

claude.ai and ChatGPT: add a connector

In apps that sign in through the browser, add a custom connector with this address and no key:

MCP URL

https://api.whatsapi.sh/mcp

The app opens whatsapi, and you sign in and press Connect. It gets its own API key, and its messages count toward your monthly quota like any other key's.

An agent with no browser

A script on a server or in a container can sign in with a short code instead of a pasted key. Start a sign-in:

curl https://api.whatsapi.sh/oauth/device_authorization -d client_id=whatsapi-agent

Show the person the verification_uri_complete link. They open it, check the code and press Connect. Meanwhile, ask for the key every 5 seconds:

# device_code comes from the first answer
curl https://api.whatsapi.sh/oauth/token \
  -d client_id=whatsapi-agent \
  -d grant_type=urn:ietf:params:oauth:grant-type:device_code \
  -d device_code=DEVICE_CODE

Until they press Connect, the answer is authorization_pending. After that, access_token is a wa_ key, sent only once. The code expires after 10 minutes.

Any other client: use a key

Create a key under API keys in the dashboard and send it in the Authorization header. Most clients take a block like this:

mcp.json

{
  "mcpServers": {
    "whatsapi": {
      "type": "streamable-http",
      "url": "https://api.whatsapi.sh/mcp",
      "headers": { "Authorization": "Bearer wa_your_key" }
    }
  }
}

What an app can see and what we keep about it: Privacy when you connect an AI app.

Loading the tool list…