WhatsApp Cloud API audit and a secure webhook

A toolkit that shows whether a WhatsApp integration is really official and who owns it, plus a webhook that verifies Meta's signature and never processes a message twice.

TypeScript
Node.js
Meta Graph API
Docker

Measured result

13/13

tests passing

The problem

Many businesses pay a WhatsApp provider without knowing whether the integration uses Meta's official API or an unofficial QR tool, or whose name the business account is in. Many webhooks don't verify signatures, so anyone can post fake messages, and they process the same message twice when Meta retries.

What I built

A read-only audit script that checks the number's platform type, WABA ownership, subscribed apps and token scopes.
A 60-item checklist in English and Arabic, in sections A to J, each item with how to check it and what passing looks like.
A zero-dependency TypeScript webhook: verification handshake, X-Hub-Signature-256 checked on the raw bytes with a constant-time compare, a fast ack, and de-duplication by message id.
Phone numbers masked in logs, a template sender with dry-run, and a Dockerfile.

Measured result

All 13 automated tests pass, including rejecting wrong signatures and tampered bodies, and processing a message exactly once on retry.
Handles Arabic (UTF-8) bodies byte-exactly without breaking the signature.

Excerpt of the WhatsApp audit checklist and the webhook test output

Checking Meta's signature in the WhatsApp webhookts

export function isValidSignature(rawBody, signatureHeader, appSecret) {
  if (!appSecret || typeof signatureHeader !== "string") return false;
  const header = signatureHeader.trim();
  if (!header.startsWith("sha256=")) return false;
 
  const receivedHex = header.slice("sha256=".length);
  // SHA-256 hex digest is always 64 chars
  if (!/^[0-9a-fA-F]{64}$/.test(receivedHex)) return false;
 
  const expected = Buffer.from(computeSignature(rawBody, appSecret).slice(7), "hex");
  const received = Buffer.from(receivedHex.toLowerCase(), "hex");
  if (expected.length !== received.length) return false;
  return timingSafeEqual(expected, received);
}

Need something similar?

WhatsApp Cloud API webhook starter + ownership audit · $15

Get the kit Order a similar service on Khamsat Message me on WhatsApp

All case studies

30/30audio tracks, 0% packet loss

A self-hosted LiveKit voice server for a Flutter app

Audio rooms on your own server instead of per-minute billing, with a one-command install and audio-only tokens.

34tests passing

An offline-first Odoo server that syncs to the cloud

The shop always works on a local Odoo, and a background daemon pushes invoices and customers to the cloud when the internet returns, without duplicates.

20/20evaluation cases

A document assistant that cites its sources

Answers only from your files, cites the file and section, says when the answer isn't there instead of inventing one, and flags instructions hidden in documents.