.gif)
We build custom applications 5x faster and cheaper 🚀
Book a Free Consultation
Stuck on an error? Book a 30-minute call with an engineer and get a direct fix + next steps. No pressure, no commitment.
Integrate WhatsApp Business with OpenClaw by treating WhatsApp as an external service: register and configure the WhatsApp Business API (Cloud or on-prem), implement a secure webhook receiver that validates WhatsApp/Meta signatures and forwards normalized events to the OpenClaw skill (installed/configured in ClawHub) via an authenticated HTTP call, and send outbound messages by calling WhatsApp’s API from a trusted external service (not from inside the ephemeral agent runtime). Keep secrets in a secret store, run retries/queues and media storage outside the agent, and debug by inspecting webhook signatures, API responses, token scopes/expiry, and ClawHub/skill invocation logs.
.png)
.png)
x-hub-signature-256), normalize the payload, and forward it to a configured skill endpoint. Replace environment variables for your setup.const express = require('express')
const crypto = require('crypto')
const fetch = require('node-fetch')
const app = express()
app.use(express.json({
verify: (req, res, buf) => {
req.rawBody = buf
}
}))
app.post('/whatsapp-webhook', async (req, res) => {
const signatureHeader = req.get('x-hub-signature-256') || ''
const appSecret = process.env.META_APP_SECRET // <b>//</b> set in your secrets manager
const expected = 'sha256=' + crypto.createHmac('sha256', appSecret).update(req.rawBody).digest('hex')
try {
// timingSafeEqual requires Buffers of same length
const sigBuf = Buffer.from(signatureHeader)
const expBuf = Buffer.from(expected)
if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
return res.status(401).send('invalid signature')
}
} catch (err) {
return res.status(401).send('invalid signature')
}
const body = req.body
// Normalize incoming message to a stable shape your OpenClaw skill expects
const normalizedEvents = []
if (Array.isArray(body.entry)) {
for (const entry of body.entry) {
if (!entry.changes) continue
for (const change of entry.changes) {
const value = change.value
// value.messages is common for incoming messages
if (value.messages) {
for (const msg of value.messages) {
normalizedEvents.push({
source: 'whatsapp',
phone_number_id: value.metadata?.phone_number_id,
from: msg.from,
id: msg.id,
timestamp: msg.timestamp,
type: msg.type,
message: msg
})
}
}
// handle statuses, message_deliveries, etc., as needed
}
}
}
// Forward to OpenClaw skill endpoint (configure SKILL_ENDPOINT and SKILL_TOKEN)
if (normalizedEvents.length > 0) {
try {
await fetch(process.env.SKILL_ENDPOINT, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${process.env.SKILL_TOKEN}`
},
body: JSON.stringify({ events: normalizedEvents })
})
} catch (err) {
// <b>//</b> store the event and error to retry later
console.error('forward to skill failed', err)
return res.status(202).send('accepted') // accept but ensure retry in your queue
}
}
res.status(200).send('ok')
})
app.listen(3000)
https://graph.facebook.com/v{version}/{PHONE_NUMBER_ID}/messages with Authorization: Bearer <ACCESS\_TOKEN>.const sendWhatsAppText = async ({ phoneNumberId, to, text, accessToken }) => {
const url = `https://graph.facebook.com/v17.0/${phoneNumberId}/messages`
const payload = {
messaging_product: 'whatsapp',
to: to,
type: 'text',
text: { body: text }
}
const res = await fetch(url, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${accessToken}`
},
body: JSON.stringify(payload)
})
const data = await res.json()
if (!res.ok) {
// <b>//</b> handle error codes and rate limiting (inspect data.error)
throw new Error(`WhatsApp send failed: ${JSON.stringify(data)}`)
}
return data
}
Speak one‑on‑one with a senior engineer about your no‑code app, migration goals, and budget. In just half an hour you’ll leave with clear, actionable next steps—no strings attached.
1
Most WhatsApp Connector auth errors come from bad tokens, expired/rotated credentials, missing environment variables in the OpenClaw agent runtime, or failing webhook signature validation. Fix by confirming the access token, app secret, phone_number_id, and that the skill in ClawHub uses the correct env vars and permissions.
2
Direct answer: Configure the Ingestor webhook as an HTTPS endpoint that authenticates and validates incoming payloads (HMAC/shared secret), stores credentials in environment variables, responds quickly with a 2xx status to acknowledge receipt, offloads processing to a background worker for OpenClaw skill invocation, and exposes logs/metrics and retry/idempotency controls.
Essentials:
const crypto=require('crypto'),express=require('express');
const app=express();app.use(express.json());
app.post('/webhook',(req,res)=>{
//<b>// validate HMAC</b>
const sig=req.headers['x-signature']||'';
const exp='sha256='+crypto.createHmac('sha256',process.env.INGESTOR_SECRET).update(JSON.stringify(req.body)).digest('hex');
if(!crypto.timingSafeEqual(Buffer.from(sig),Buffer.from(exp)))return res.sendStatus(401);
//<b>// enqueue and ack</b>
enqueueJob(req.body);
res.sendStatus(202);
});
3
Direct answer: A sync failure typically indicates auth, webhook, or network/API errors between your OpenClaw agent/skill and the external service. Triage by checking agent runtime logs, validating env vars/OAuth tokens, replaying the failing HTTP request, and moving retry/stateful logic outside the agent if needed.
// validate env
if (!process.env.API_KEY) throw new Error('Missing API_KEY');
console.log('env OK');
4
Short answer: verify the skill's environment variables and credentials, confirm the ClawHub skill configuration and permission scopes, reproduce failing API calls from logs, and move stateful or scale-sensitive pieces outside the agent runtime if needed.
This prompt helps an AI assistant understand your setup and guide you through the fix step by step, without assuming technical knowledge.
From startups to enterprises and everything in between, see for yourself our incredible impact.
They do complex work on extremely fast timelines and effectively manage the testing and pre-launch process to deliver the best possible product. I'm extremely impressed with their execution ability.
