Updated on October 25, 2026
An unofficial WhatsApp API is a library or service that drives a WhatsApp Web session opened with a QR code, such as Baileys, WPPConnect or Evolution API in Baileys mode. It doesn’t charge per message, but it breaks WhatsApp’s Terms of Service, which forbid unauthorized automated access, so the number can be banned at any time. The official API (Meta’s Cloud API) has per-message costs and template rules, but it’s the only authorized route; migrating pays off when WhatsApp is a critical part of your operation.
How each one works
Unofficial API. The software connects to WhatsApp’s servers as if it were WhatsApp Web or a linked device. You scan a QR code with your phone, the session is stored on the server and the library exposes functions to send and receive messages. Baileys does it over WebSocket; WPPConnect exports WhatsApp Web functions to Node.js. None of them is related to Meta: Baileys’ README says the project isn’t affiliated with, authorized or endorsed by WhatsApp.
Official API. The WhatsApp Cloud API is hosted by Meta. Your system makes HTTPS calls with an access token and receives events through webhooks. The number is registered on the platform, linked to a business portfolio, and the business accepts the WhatsApp Business Platform terms.
Evolution API is a special case: according to its own README, it supports both a Baileys-based connection and the official Cloud API. What defines the risk is the channel you pick, not the tool’s name.
What the Terms of Service say
WhatsApp’s Terms of Service, in the acceptable use section, forbid:
- accessing or using the service “through automated or other means” in unauthorized ways;
- creating accounts through unauthorized or automated means;
- reverse engineering, modifying or extracting code from the service;
- sending impermissible communications such as bulk messaging, auto-messaging and auto-dialing.
The same terms say WhatsApp may disable or suspend the account of anyone who breaks these rules. A library that emulates WhatsApp Web to automate messages falls right into those items. Baileys’ README itself states that its maintainers don’t condone uses that violate the Terms of Service and discourage bulk or automated messaging.
Why numbers get banned
There’s no public list of triggers, which is exactly what makes the risk hard to manage. Teams running unofficial APIs commonly see:
- Bans without warning, sometimes right after connecting, sometimes months later.
- Breakage after WhatsApp updates, forcing rushed library upgrades.
- Sessions that drop and ask for a new QR scan, with someone having to grab the phone.
Reports and blocks from recipients matter in any model. The difference is that with an unofficial API, using the tool is already a violation, so there’s no “correct use” that removes the risk. If the number is banned, recovering it means asking WhatsApp for a review, with no deadline or guarantee.
The official API has enforcement too: Meta tracks message quality, can pause templates and can restrict accounts that violate the WhatsApp Business Messaging Policy. But the risk comes from what you send and to whom, not from the fact that you’re connected. Warning signs show up first, in your phone number quality rating and limits, and there are support and appeal channels.
Side-by-side comparison
| Criterion | Unofficial API (Baileys, WPPConnect, Evolution in Baileys mode) | Official API (Cloud API) |
|---|---|---|
| Authorization | No; breaks the Terms of Service | Yes, Meta’s product for businesses |
| Connection | QR code and a session stored on the server | Access token and HTTPS |
| Depends on a phone | Yes, the primary device must stay active | No |
| Ban risk from using the tool | High and unpredictable | None; risk comes from quality and policy |
| Starting a conversation | Free-form message | Approved template |
| Replying to a customer | Free-form | Free-form inside the 24-hour window |
| Per-message cost | No Meta charge | Per delivered message, by category and country |
| Webhooks | Each library’s own format | Format documented by Meta |
| Stability | Depends on reverse engineering | Versioned API with changelog and deadlines |
| Groups and broadcast lists | Broad access | Groups API with its own rules; no broadcast lists |
| Support | Community | Meta and provider support |
On cost: Meta charges no monthly fee for the official API, and some messages are free. Details in is there a free WhatsApp API?.
When to migrate to the official API
Migrate now if at least one of these is true:
- WhatsApp is a main channel for sales, collections or customer service, and a ban would stop the operation;
- you sell software (CRM, ERP, platform) and connect your customers’ numbers;
- you’ve already lost a number or sessions drop often;
- you need several agents, AI or system integrations with reliable history;
- your customer or your legal team requires compliance with WhatsApp’s terms.
You can wait, or may not need the API at all, if usage is manual, low-volume and the WhatsApp Business app does the job.
Review carefully before migrating if your flow depends on large groups, broadcast lists, reading contacts’ status updates or free-form messages to people who haven’t written to you in the last 24 hours. The official API doesn’t replicate those uses, and your product will need to change.
How to migrate without stopping the operation
- Inventory. List what is a reply to the customer (stays the same) and what is a business-initiated message (becomes a template).
- Meta account. A business portfolio, ideally verified. See how to get access to the WhatsApp API.
- Number. If it’s on the WhatsApp Business app, you can use coexistence. If it’s on regular WhatsApp, you need to free the number first. See how to free up a number that’s already on WhatsApp.
- Templates. Create and get them approved before switching; it’s the step that depends on Meta.
- Sending and webhooks. Replace the sending layer and rewrite event handling.
- Shut down the old session before registering the number on the Cloud API.
An adapter for incoming events
Most of the work is in the webhook, because the format changes. One way to reduce the impact is to convert Meta’s event into the same internal object your system already uses:
// Converts the Cloud API webhook into the internal format used before the migration
export function normalizeWebhook(body) {
const events = [];
for (const entry of body.entry ?? []) {
for (const change of entry.changes ?? []) {
const v = change.value ?? {};
for (const m of v.messages ?? []) {
events.push({
kind: 'message',
from: m.from, // wa_id, no @s.whatsapp.net
messageId: m.id, // wamid...
text: m.text?.body ?? m.button?.text ?? null,
mediaId: m.image?.id ?? m.document?.id ?? m.audio?.id ?? null,
receivedAt: new Date(Number(m.timestamp) * 1000),
channel: v.metadata?.phone_number_id,
});
}
for (const s of v.statuses ?? []) {
events.push({ kind: 'status', messageId: s.id, status: s.status, error: s.errors?.[0]?.code ?? null });
}
}
}
return events;
}Note that media arrives as a media_id, not a file: you need an extra call to download it. And errors arrive in the status webhook, not in the send response. The most common ones are listed in WhatsApp API errors.
Migrating to the official API with Vectalk
Vectalk is a proxy for the official WhatsApp Cloud API: payloads and webhooks are Meta’s, and only the base URL (https://apis.vectalk.com.br/api) and the token change. You pay Vectalk, and Vectalk pays Meta. Vectalk supports coexistence, so if your number is on the WhatsApp Business app you can connect it to the API without giving up the app.
Check the quickstart (docs in Portuguese) and sign up at apps.vectalk.com.br/register. To plan the migration with the team, use the contact page.
Frequently asked questions
Is Evolution API official?
Evolution API is an open-source project that doesn’t belong to Meta. It offers two modes: one based on Baileys, which emulates WhatsApp Web and isn’t authorized, and one that uses the official Cloud API. Only the second follows Meta’s rules.
Does using Baileys always get you banned?
Not necessarily, but the risk exists from day one and can’t be removed, because the use itself breaks the Terms of Service. Many numbers work for months and then go down without warning.
My number was banned while using an unofficial API. Can I use it on the official API?
First you need to recover the number by asking WhatsApp for a review. Only after it’s reinstated can it be registered on the Cloud API.
Can a number never be blocked on the official API?
It can be restricted if the business violates policies or has low quality, for example by messaging people who didn’t opt in. The difference is that the risk depends on your behavior and gives warning signs first, such as a drop in quality.
Can I keep the same number when migrating?
In most cases, yes. If the number is on the WhatsApp Business app, coexistence lets you connect it to the API while keeping the app. If it’s in an unofficial session, disconnect the session before registering.
Official sources checked on October 25, 2026: WhatsApp Terms of Service, WhatsApp Business Messaging Policy, Cloud API overview, Coexistence: onboarding WhatsApp Business app users, Baileys README, WPPConnect README, Evolution API README.