Send WhatsApp Messages Using PHP

<?php
// send-whatsapp.php: run with  WA_API_KEY=xxxx php send-whatsapp.php
$payload = [
    'to'       => '919876543210',             // country code + number
    'template' => 'order_shipped',            // approved template name
    'language' => 'en',                       // the language it was approved in
    'params'   => ['Priya', 'A1023', 'https://avz.in/t/9KX2'],   // {{1}}, {{2}}, {{3}}
];

$ch = curl_init('https://whitelabled.securesmsc.com/api/v2/whatsapp/send');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CONNECTTIMEOUT => 5,
    CURLOPT_TIMEOUT        => 20,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('WA_API_KEY'),
        'Content-Type: application/json',
        'Accept: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$body = curl_exec($ch);
$http = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$res = json_decode((string) $body, true);
if ($http === 200 && ($res['status'] ?? '') === 'success') {
    echo "Sent: {$res['data']['message_id']}\n";       // a WhatsApp message id (wamid...)
} else {
    echo "Failed ($http): " . ($res['code'] ?? '') . ' ' . ($res['message'] ?? '') . "\n";
}

{
  "status": "success",
  "data": {
    "message_id": "wamid.HBgMOTE5ODc2NTQzMjEwFQIAERgSQzVGRDY0",
    "id": 5521,
    "to": "919876543210"
  }
}

<?php
$payload = [
    'to'                => '919876543210',
    'template'          => 'invoice_ready',
    'params'            => ['Priya', 'INV-2026-0412', '4,720'],
    'header_media_url'  => 'https://files.example.com/invoices/INV-2026-0412.pdf',
    'header_media_type' => 'document',              // or 'image' / 'video'
    'header_filename'   => 'Invoice-INV-2026-0412.pdf',
];

<?php
$payload = [
    'to'      => '919876543210',
    'message' => 'Your appointment is tomorrow at 4:30 PM. Can you make it?',
    'buttons' => [
        ['id' => 'appt_yes',        'title' => 'Yes, confirm'],
        ['id' => 'appt_reschedule', 'title' => 'Reschedule'],
        ['id' => 'appt_cancel',     'title' => 'Cancel'],
    ],
];
// Outside the window this returns 422 with code "template_required".

<?php
function notify_shipped(string $phone, string $name, string $order, string $url): string
{
    $wa = api_post('/whatsapp/send', [
        'to' => $phone, 'template' => 'order_shipped', 'params' => [$name, $order, $url],
    ]);
    if (($wa['status'] ?? '') === 'success') {
        return 'whatsapp';
    }

    // Fall back only when WhatsApp clearly did not take the message.
    if (in_array($wa['code'] ?? '', ['invalid_recipient', 'template_required'], true)) {
        api_post('/sms/send', [
            'sender_id'       => 'AVNZON',
            'recipient'       => $phone,
            'message'         => "Your order {$order} has been shipped. Track it here: {$url} -AVNZON",
            'dlt_template_id' => '1107161234567890123',
        ]);
        return 'sms';
    }
    return 'failed';
}
// api_post(): the curl_init() call from section 2, wrapped to return the decoded JSON.

<?php
const GRAPH_VERSION = 'v26.0';

$phoneNumberId = getenv('WA_PHONE_NUMBER_ID');
$body = [
    'messaging_product' => 'whatsapp',
    'recipient_type'    => 'individual',
    'to'                => '919876543210',
    'type'              => 'template',
    'template'          => [
        'name'       => 'order_shipped',
        'language'   => ['code' => 'en'],
        'components' => [[
            'type'       => 'body',
            'parameters' => [                     // positional: same order as {{1}}, {{2}}, {{3}}
                ['type' => 'text', 'text' => 'Priya'],
                ['type' => 'text', 'text' => 'A1023'],
                ['type' => 'text', 'text' => 'https://avz.in/t/9KX2'],
            ],
            // Named-parameter templates add 'parameter_name' => 'first_name' to each entry.
        ]],
    ],
];

$ch = curl_init('https://graph.facebook.com/' . GRAPH_VERSION . "/{$phoneNumberId}/messages");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 20,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('WA_ACCESS_TOKEN'),
                               'Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($body),
]);
$res = json_decode((string) curl_exec($ch), true);
curl_close($ch);
// Success: $res['messages'][0]['id'] is the wamid. Errors: $res['error']['code'].

<?php
// webhook.php
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $ok = ($_GET['hub_mode'] ?? '') === 'subscribe'
       && hash_equals((string) getenv('WA_VERIFY_TOKEN'), (string) ($_GET['hub_verify_token'] ?? ''));
    http_response_code($ok ? 200 : 403);
    header('Content-Type: text/plain');
    echo $ok ? (string) ($_GET['hub_challenge'] ?? '') : '';
    exit;
}

$raw       = file_get_contents('php://input');
$expected  = 'sha256=' . hash_hmac('sha256', $raw, (string) getenv('WA_APP_SECRET'));
$signature = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? '';
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
// Queue $event for processing and return 200 quickly; Meta retries slow or failed deliveries.
http_response_code(200);