API + Integrations

WhatsApp Business API and CRM Integration

Push leads from any CRM straight to a WhatsApp flow. Receive every inbound reply as a signed webhook. Built on Meta WhatsApp Cloud API v25.0 with three security layers on every call.

Start Free Trial - 14 days free See a Demo

API

POST /api/v1/flows/{flowId}/enroll-by-phone
{
  "phone": "+919876543210",
  "firstName": "Priya",
  "externalLeadId": "crm-uuid",
  "customFields": {
    "campaign": "diwali-2025"
  }
}

202 AcceptedContact enrolled in flow

Any CRM

→

dripBot

→

Built to integrate

One contract, any CRM

dripBot is intentionally CRM-agnostic. The same REST + webhook contract powers a HubSpot integration, a Zoho integration, and the homegrown CRM your team built in 2019. No per-CRM connectors needed.

REST API

Push leads in, get message status out

A small, opinionated REST API: enroll a contact in a flow, send a template, look up a contact, update tags. JSON in, JSON out. Full OpenAPI 3.0 spec. Works with any HTTP client your CRM can run.

✓
enroll-by-phone, send template, contact upsert
✓
OpenAPI 3.0 spec + machine-readable schema
✓
Per-key rate limits + per-tenant enrollment caps

curl

# 1. Generate a scoped API key
GET /api/v1/settings/api-keys
 
# 2. Enroll a lead from your CRM
POST /api/v1/flows/abc/enroll-by-phone
X-API-Key: dbk_live_***
X-Signature: sha256=***
X-Timestamp: 1716840000
X-Idempotency-Key: uuid

Webhooks

Inbound replies, signed and delivered

Every inbound WhatsApp message, every delivery receipt, every status change can fire a webhook to your endpoint. Signed with HMAC-SHA256, time-stamped, and idempotency-keyed so you can verify and dedupe with no surprises.

✓
HMAC-SHA256 signature over timestamp + body
✓
BullMQ delivery with retry + dead-letter queue
✓
Per-event toggles (inbound, status, opt-out, lead.new)

Webhook payload

POST https://your-crm.com/hooks/dripbot
X-Signature: sha256=ab92...
X-Timestamp: 1716840012
 
{
  "event": "lead.status",
  "externalLeadId": "crm-uuid",
  "status": "qualified",
  "note": "Tapped Check Eligibility"
}

Meta Cloud API

Built on the official Meta WhatsApp Cloud API

dripBot is built on Meta WhatsApp Cloud API v25.0 - the official Meta Business Platform used by enterprise customers. No third-party message gateways. No unofficial workarounds. Your messages travel through the same infrastructure as Fortune 500 traffic.

✓
Meta Cloud API v25.0 (kept current with Meta releases)
✓
Coexistence Mode supported (keep WhatsApp Business app)
✓
Full signed webhook from Meta + dripBot relay

Architecture

Your CRM

↓ REST + HMAC

dripBot tenant

↓ Meta Cloud API v25.0

WhatsApp Business

↑ Inbound webhook (signed)

Your CRM

How it works

From "we should integrate" to live calls in an afternoon

Three layers of security, two endpoints, one webhook URL. The whole contract fits on one page.

Generate a scoped API key

From Settings -> API Keys, generate a key prefixed dbk_live_. Stored as SHA-256 hash; shown once. Tenant-bound, integration-scope only.

→

Configure your CRM webhook URL

Paste your endpoint URL and signing secret into dripBot. We sign every outbound delivery with HMAC-SHA256 and retry with backoff on failure.

→

Call enroll-by-phone

Send a POST from your CRM when a lead enters. dripBot validates phone, dedupes, enrolls into the flow, and respects plan + daily caps.

FAQ

API integration questions

Which CRMs does dripBot integrate with?

Any CRM that speaks HTTP. dripBot exposes a REST API for outbound calls and accepts signed webhooks for inbound events. Customers run integrations with HubSpot, Zoho, Salesforce, Pipedrive, and many in-house CRMs. There are no per-CRM connectors needed because the contract is generic.

How is authentication handled?

API keys are scoped per tenant, prefixed (dbk_live_...), and stored as SHA-256 hashes. Every integration request must include an X-API-Key header, plus an HMAC-SHA256 X-Signature over a timestamp + idempotency key + body, plus an X-Idempotency-Key. The three layers together prevent forgery, tampering, and replay.

What are the rate limits?

Per-key rate limits apply to integration endpoints (default 100 req/min). enroll-by-phone also has a per-tenant daily cap to protect your WhatsApp messaging quota. Limits are configurable on Business plans.

Is there a sandbox or test environment?

You can create a separate API key labeled "staging" on the same tenant and point your CRM staging environment at it. dripBot does not run a separate sandbox cluster - your live tenant handles both staging and production traffic with clear key labels and audit logs.

Is dripBot built on the official Meta WhatsApp API?

Yes. dripBot is built on Meta WhatsApp Cloud API v25.0, the official Meta Business Platform. Every outbound message and every inbound webhook passes through Meta's infrastructure - no third-party gateways, no unofficial workarounds.