WhatsApp business messages, verified and safe
A WhatsApp assistant backend that rejects forged messages.
A working sample we built to show how we would solve a problem like this. It is not a delivered project.
In plain terms
A WhatsApp assistant backend that receives customer messages through WhatsApp's official business connection and looks up vehicle details. It proves the two things that make it safe. It correctly answers WhatsApp's verification handshake and rejects a wrong key, and it checks the signature on every incoming message so forged messages are ignored.
- Answers WhatsApp's verification handshake correctly.
- Rejects a wrong key with a clear refusal.
- Ignores any message whose signature does not match.
What this does not claim: Built and tested on a local copy, not on a live WhatsApp business number.
Technical details
Implements Meta's GET /webhook verification (hub.mode, hub.verify_token, hub.challenge, with a 403 on a wrong token) and HMAC-SHA256 verification of the X-Hub-Signature-256 header on incoming events. Compiled and exercised against a live local instance, with recorded output.
- ASP.NET Web API (.NET 8)
- Meta WhatsApp Cloud API webhooks
- HMAC-SHA256
Need something like this?
Tell us the problem in your own words. We reply with a plain, practical plan.
Discuss a project like this