npm install @gaviwhatsapp/whatsapp

GAVIVENTURES_API_KEY=gv_...

import { WhatsApp } from '@gaviwhatsapp/whatsapp'

const wa = new WhatsApp({ apiKey: process.env.GAVIVENTURES_API_KEY! })

await wa.send({ to: '+919876543210', text: 'Hello from my app!' })

await wa.sendTemplate({
  to: '+919876543210',
  template: 'order_confirmation',
  language: 'en',
  variables: { '1': 'ORD-1234', '2': '$49.99' },
})

await wa.sendMedia({
  to: '+919876543210',
  type: 'image',
  url: 'https://example.com/receipt.png',
  caption: 'Your receipt',
})

await wa.sendMedia({
  to: '+919876543210',
  type: 'document',
  url: 'https://example.com/invoice.pdf',
  filename: 'invoice.pdf',
})

const templates = await wa.getTemplates()
// Returns: { templates: [{ name, status, category, language, ... }] }

await wa.broadcast({
  recipients: ['+919876543210', '+919876543211'],
  template: 'promo_offer',
  language: 'en',
  variables_per_recipient: [
    { '1': 'Alice', '2': '20%' },
    { '1': 'Bob', '2': '15%' },
  ],
})

const webhook = await wa.registerWebhook({
  url: 'https://myapp.com/api/whatsapp-webhook',
  events: ['message.received', 'message.delivered', 'message.read'],
})
// Save webhook.secret — use it to verify HMAC signatures on every event.
// Treat it as opaque; do NOT strip prefixes or decode it.

{
  "event": "message.received",
  "timestamp": "2026-04-16T22:51:33.273Z",
  "message_id": "wamid.HBgM...",
  "from": "91987654321",
  "type": "text",
  "text": "your plain message body here"
}

import express from 'express'
import { createHmac, timingSafeEqual } from 'crypto'

const app = express()

app.use(
  express.json({
    verify: (req, _res, buf) => {
      // Capture the raw body BEFORE JSON parsing — required for HMAC.
      ;(req as any).rawBody = buf.toString('utf8')
    },
  })
)

app.post('/webhook', (req, res) => {
  const received = req.headers['x-gaviventures-signature'] as string
  const computed = createHmac('sha256', process.env.WEBHOOK_SECRET!)
    .update((req as any).rawBody)
    .digest('hex')

  const sigOk =
    typeof received === 'string' &&
    received.length === computed.length &&
    timingSafeEqual(Buffer.from(received), Buffer.from(computed))

  if (!sigOk) return res.sendStatus(401)

  const event = req.body
  if (event.event === 'message.received') {
    const from = '+' + event.from   // prepend + for replies
    const text = event.text         // plain string
    console.log(`Received from ${from}: ${text}`)
  }

  return res.sendStatus(200)
})

app.listen(3001)

// app/api/whatsapp-webhook/route.ts
import { createHmac, timingSafeEqual } from 'crypto'
import { NextRequest, NextResponse } from 'next/server'

export async function POST(req: NextRequest) {
  const rawBody = await req.text() // raw bytes BEFORE parsing
  const received = req.headers.get('x-gaviventures-signature') ?? ''
  const computed = createHmac('sha256', process.env.WEBHOOK_SECRET!)
    .update(rawBody)
    .digest('hex')

  const sigOk =
    received.length === computed.length &&
    timingSafeEqual(Buffer.from(received), Buffer.from(computed))

  if (!sigOk) {
    return new NextResponse('invalid signature', { status: 401 })
  }

  const event = JSON.parse(rawBody)
  if (event.event === 'message.received') {
    const from = '+' + event.from
    const text = event.text
    console.log(`Received from ${from}: ${text}`)
  }

  return NextResponse.json({ ok: true })
}

import { verifyWebhookSignature } from '@gaviwhatsapp/whatsapp'

const ok = verifyWebhookSignature(rawBody, signature, secret)

// app/api/orders/route.ts
import { WhatsApp } from '@gaviwhatsapp/whatsapp'

const wa = new WhatsApp({ apiKey: process.env.GAVIVENTURES_API_KEY! })

export async function POST(req: Request) {
  const order = await req.json()

  await wa.sendTemplate({
    to: order.customerPhone,
    template: 'order_confirmation',
    language: 'en',
    variables: { '1': order.id, '2': order.total },
  })

  return Response.json({ success: true })
}