Host a WhatsApp Bot on a VPS (Legal, Official API)

How a WhatsApp Bot Runs (Architecture)

A WhatsApp bot is three pieces talking. Your bot code (Node.js, Python or PHP) holds the conversation logic and any customer data. Meta's WhatsApp Business Cloud API is the transport: when a customer messages your number, Meta POSTs a webhook to your server's HTTPS endpoint, and your reply goes back out through the same API.

The VPS earns its place because of that webhook. The endpoint needs a public IP, valid SSL and a process that survives deploys and reboots. A laptop sleeps and shared hosting rarely lets you run a process manager or open ports — a VPS does all three on its smallest tier.

Nothing else about the stack is exotic. The VPS server tiers are sized for exactly this pattern, and the Node deployment pattern below is the same one Flask and Django apps use.

WhatsApp Business Cloud API Basics

The Cloud API is Meta's official interface for sending and receiving WhatsApp messages over plain HTTPS. You create an app on Meta for Developers, add the WhatsApp product, verify the business, and Meta issues a phone number ID plus an access token that your server sends with every request.

• App and product — a Meta developer app with the WhatsApp product added.
• Business verification — done once in Meta Business Suite, required for production numbers.
• Phone number ID and token — the two credentials every API call carries.
• Templates — pre-approved message formats for business-initiated conversations.

Meta also lists unofficial libraries — Baileys and whatsapp-web.js are the common ones — that drive a personal account like a linked device. They work for hobby projects, but they break WhatsApp's terms and Meta bans numbers it detects automating this way. For anything customer-facing, use the Cloud API and keep the library experiments off a number you care about.

VPS Requirements and Sizing

Webhook bots are light. A Cloud API bot receives POSTs and makes API calls; it does not render pages or hold connections open. A 1-2 GB RAM VPS runs a typical India-facing bot with headroom for the dashboard or CRM behind it. Library-based bots that spawn a headless browser are the exception — start those at 4 GB.

• Public IPv4 address reachable on port 443.
• Ubuntu LTS (22.04 or 24.04) or a similar Linux distribution.
• Node.js 18+ or Python 3.10+ runtime.
• SSL certificate on the webhook domain — Let's Encrypt is free.
• Process manager — PM2 for Node, systemd or supervisor for Python.
• Nightly backups of the bot code, database and .env file.

Step 1: Meta Developer App and Credentials

Everything on Meta's side happens in the developer console before your server is involved.

1. Go to developers.facebook.com, open My Apps and create a Business-type app.
2. Add the WhatsApp product. Meta creates a test number with five allowed recipients.
3. Link your WhatsApp Business Account and complete business verification in Meta Business Suite.
4. Add the production phone number if the test number will not do.
5. Generate a permanent System User access token and note the phone number ID — the bot needs both.

Step 2: Deploy the Bot With PM2 and SSL Webhook

On the VPS the goal is a bot process that survives reboots behind an HTTPS URL Meta can reach.

1. SSH in as a non-root user: ssh user@your.server.ip.
2. Install Node.js 18+ from NodeSource, or Python 3.10+, plus git.
3. Clone or upload the bot, then npm install (or pip install -r requirements.txt).
4. Start it with pm2 start index.js --name wa-bot, then pm2 startup and pm2 save so it relaunches after a reboot.
5. Point Nginx at the bot port, issue a certificate with certbot --nginx, and open only SSH, HTTP and HTTPS in ufw.

Verify before moving on: pm2 list after a reboot shows the bot online, and the padlock in a browser on your webhook URL confirms TLS. The certificate renews automatically while certbot's timer runs.

Step 3: Test, Templates and Go Live

Meta gates the last mile behind a test number and template approval, so clear both before announcing the number.

1. In App Dashboard → WhatsApp → API Setup, send a test message to one of the five allowed recipients.
2. Open Webhooks → Configuration, enter the HTTPS callback URL and a verify token, and have your server echo back the hub.challenge value Meta sends.
3. Subscribe to the messages field so inbound events start arriving.
4. Create a message template — name, category, body with {{1}} variables — and submit it for approval.
5. Move the bot to the production number, swap the phone number ID and token in .env, and run pm2 restart wa-bot.

Monthly Costs and Scaling Notes

Two bills sit on this stack. Meta charges for Cloud API conversations at its published rates. The VPS side is WebJi's: the Linux VPS tiers that carry a bot are quoted by email before any payment, and 18% GST appears on the invoice.

Scale the boring way. Watch pm2 monit and free RAM; if the bot grows a database, media handling or its own dashboard, step up one tier before adding anything else. If you would rather not manage the server at all, WhatsApp bot hosting bundles the VPS, SSL and deployment as a service. Free migration from another provider is subject to terms and approval — email support@webji.services with the current server details and we size it first.