Someone messages your business at 11pm asking whether you deliver on Saturdays. The phone sits there. A WhatsApp chatbot would have answered in two seconds, and the customer would have ordered instead of going to bed. The part most people get wrong is assuming that means an expensive monthly subscription. It doesn't have to. Meta hosts the WhatsApp Cloud API itself, and with free-tier hosting and a bit of patience, you can have a working bot without a recurring platform bill.
What "free" actually means with the WhatsApp Business API
There are two separate costs people mix up: the software that runs your bot, and the messages themselves. The Cloud API is hosted by Meta and you don't pay for API access or for a sandbox. What you pay for, at the time of writing, is mainly template messages — the pre-approved messages you send to someone who hasn't messaged you recently. When a customer writes to you first, you get a 24-hour service window in which you can reply with free-form text. Those customer-initiated conversations have historically been free, though pricing has changed more than once and will change again. Check Meta's current pricing page before you plan a campaign around it.
The practical upshot: a support or enquiry bot that mostly responds to people can run for very little. A bot that proactively pushes promotions to cold contacts will cost you, whatever tool you build it with.
Before you write any code
Gather these first. Skipping the phone number step in particular causes days of confusion.
- A Meta Business account and a Facebook Page for the business.
- A phone number that is not currently registered to WhatsApp or the WhatsApp Business app. If it is, deregister or delete that account first, or the migration will fail.
- A domain with HTTPS, since webhooks must be secure. For local testing, a tunnelling tool works fine.
- Business documents — registration, tax or utility paperwork matching your business name — if you plan to verify the business later.
- Somewhere to run a small web service, or a no-code builder with a usable free plan.
Step 1: Create the app and claim your test number
Sign in at developers.facebook.com and create an app of type Business. In the dashboard, add the WhatsApp product. Meta immediately gives you a test phone number and a temporary access token that expires in about 24 hours. In the API Setup panel, add up to five recipient numbers — your own mobile among them — and send the built-in hello_world template. If that message lands on your phone, your account is wired correctly and everything after this is logic, not plumbing.
Step 2: Build the bot and connect the webhook
Incoming messages are pushed to your server as JSON. You reply by posting to the Graph API endpoint for your phone number ID with your token in the authorization header. Two requests matter:
- A GET request Meta sends once to verify your webhook. Compare the token it sends against a secret you chose, and echo back the challenge value if they match.
- A POST request for every incoming message. Dig out the sender's number and the message text, decide on a reply, send it.
Validate the payload signature header on each POST rather than trusting the body blindly. It takes four lines and stops anyone from forging messages into your bot.
Choose somewhere free to run it
Cloudflare Workers, Vercel and Render all have free tiers that handle a chatbot comfortably. So does a self-hosted automation tool running on a spare machine at home. The catch with free tiers is cold starts: if your service naps between requests, the reply may take several seconds. Keep your handler fast, don't call a slow API before replying, and let confirmations arrive in a second message.
Start with a decision tree, not a personality
Your first version should be dull and reliable. Keyword rules get you a long way: "hours" returns opening times, "order" asks for an order number, "refund" explains the policy, anything unrecognised offers a human. Store a small state per phone number — in SQLite, a free key-value store, or a hosted Postgres free tier — so multi-step flows like an order lookup don't restart every message.
Step 3: Swap the temporary token for a permanent one
That 24-hour token is for testing only. In Business Settings, create a System User, assign it your app and WhatsApp assets, and generate a token without an expiry. Put it in an environment variable, never in a public repository. Anyone holding that token can message your customers as you, so rotate it the moment you suspect a leak.
Step 4: Move from the test number to your own
Add your real business number in WhatsApp Manager, verify it by SMS or voice, and set a display name that matches how customers know you. Once approved, subscribe your webhook to the new phone number ID and point the bot at it. Business verification, which is free but requires those documents, raises your messaging limits and lets you apply for a verified badge.
Staying free without getting banned
The fastest way to lose a number is to use an unofficial library that automates a personal WhatsApp account. Those tools break the terms of service and numbers get blocked, usually without appeal. Stick to the official API.
Other habits worth forming: reply inside the 24-hour window or expect the send to fail; include a way for people to opt out; never import a contact list that never asked to hear from you; and keep answers short enough to read on a phone. If your bot handles payments, health details or anything regulated, get proper advice about your obligations rather than guessing from a tutorial.
Your pre-launch checklist
- Webhook verification returns the challenge correctly.
- Signature validation is switched on and tested.
- The permanent token lives in environment variables.
- Every keyword you support has been tried from a real phone, including typos and a blank message.
- There's a clear path to a human, and a fallback message when nothing matches.
- Your privacy policy mentions that you handle messages through WhatsApp.
- Logging captures errors without hoarding more personal data than you need.
Run that list once, and you'll have something you can leave running quietly in the background — answering the 11pm questions while you sleep, and only costing you money when you decide to start conversations yourself.
Photo: AzamKamolov / Pixabay
