Saltar al contenido principal
    Skip to main content

    How to build a WhatsApp AI agent: steps, components and common mistakes

    You need a Meta app with a number on the Cloud API, a webhook server, an AI model, your data and a handover to a person. The steps and typical mistakes.

    By Filip Balik, co-founder · Updated on 17 October 2026

    To build a WhatsApp AI agent you need five pieces: a Meta app with a number registered on the Cloud API, a server that receives messages by webhook, an AI model you call through an API, access to your business data, and a way to hand the conversation over to a person. The steps are: define the scope, set up the account, build the webhook, connect the model, create templates, test and launch.

    The pieces

    Piece What it does Who provides it
    Business portfolio and Meta app Groups your WhatsApp account, your number and the permissions You, in Meta Business Suite and the developer dashboard
    Phone number It is the agent's identity in front of your customers You, with a number of your own
    Cloud API and webhooks Meta notifies you of each incoming message and you reply with an API call Meta
    Server Receives the notifications, decides what to do and calls the model Your developer or your provider
    AI model Understands the question and drafts the reply Anthropic, OpenAI or another, through an API
    Business data Frequently asked questions, calendar, CRM, order status Your existing systems
    Handover to a person Takes the conversation away from the bot and puts it in front of your team Your server and your support inbox

    The platform relies on webhooks: every message a customer sends to your number reaches you that way, and so do the delivered and read notifications. Without a server to receive them, there is no agent.

    Before you touch anything, define the scope

    Write down, on a single page:

    • The three or four tasks the agent will do. For example, answering questions about opening hours and paperwork, and booking viewings.
    • Where each piece of data comes from: a frequently asked questions document, the calendar, the CRM.
    • What it will never do: payments, health data, negotiations.
    • When it hands over to a person and who picks it up, during working hours and outside them.
    • Which messages your business will send on its own initiative: reminders, alerts. Those need templates and consent.

    This page saves you from an expensive mistake: building a bot that tries to do everything and does nothing well.

    Step by step

    1. Create the app with the WhatsApp use case. In Meta's developer dashboard, create an app with the "Connect with customers through WhatsApp" use case and link it to a business portfolio. Follow the getting started guide: Meta automatically creates a test account and a test number. Test accounts have relaxed limits and don't ask for a payment method to send templates.

    2. Verify your business. Verifying the portfolio improves your sending capacity, and it is one of the ways to move from the initial limit of 250 users to 2,000 every 24 hours outside the customer service window.

    3. Choose the number. It must be yours, with a country code, and able to receive SMS or calls. If it is already on WhatsApp, that account has to be deleted before you register it, unless you use coexistence through a Meta partner.

    4. Decide where messages are stored before you register the number. Local storage can only be switched on while the number is unregistered. The regions include the EU, in Germany (code DE). If you turn it on later, you have to deregister the number and register it again.

    5. Generate a permanent token. The temporary token in the dashboard expires quickly. Create a system user in the business settings and generate its token with the business_management, whatsapp_business_messaging and whatsapp_business_management permissions. Store it as a secret, never in the code.

    6. Set up the webhook. Your server needs a public address with a valid TLS certificate; self-signed certificates don't work. Meta checks it with a GET request, and your server must send back the value it receives:

      if hub.verify_token == YOUR_TOKEN:
    respond 200 with hub.challenge

      After that, each message arrives by POST with a signature in the X-Hub-Signature-256 header. Calculate the HMAC-SHA256 of the body with your app secret and compare the two: if they don't match, discard the notification. Respond 200 as soon as you have stored it, and process it afterwards.

    7. Connect the AI model. Your server sends the model the instructions, the data that particular question needs and the recent history. Give it specific tools rather than free access: "check free calendar slots", "create a repair report". Tell it to answer only with what it finds and to hand over when it doesn't know.

    8. Program the handover to a person. Define the triggers, alert the team, keep the bot quiet in that chat and pass on a summary. The WhatsApp policy requires clear escalation paths when you automate: handover to a live agent in the chat, phone, email, web, the shop itself or a form.

    9. Create the templates. Anything you send outside the 24-hour window needs an approved template, and the review can take up to 24 hours.

    10. Go live. Add a real number and a payment method. Without a payment method, Meta stops delivering service messages from the 1,001st each month.

    The 24-hour window and templates

    This is the rule that shapes the design more than any other. When a customer messages or calls you, a 24-hour customer service window opens, and each new message from them restarts it. Inside it, the agent replies with free text, images, documents, lists or buttons. Outside it, the agent can only send templates.

    Templates come in three categories: marketing, utility and authentication. A template that mixes an alert with a promotion counts as marketing, which in Spain is the most expensive category. And to send any of them you need the customer's prior opt-in: it has to be clear that they agree to receive messages, and from which business.

    In practice, the agent needs to know at every moment whether the window is open. If it isn't, it must use the right template or stay quiet. Prices by category are in WhatsApp Business API pricing in Spain.

    How to test it before opening it to customers

    1. Use the test number with your team's phones.
    2. Write a set of real questions, taken from your emails and chats, with the correct answer next to each one. Run the whole set again every time you change the instructions or the model.
    3. Include trick questions: topics outside its scope, requests for data it must not give, insults, and messages in another language, which for many businesses on the Costa Blanca is an everyday case.
    4. Test the handover both during and outside working hours.
    5. Test the failures: the model is slow, your calendar doesn't respond, Meta sends a notification twice. Meta retries failed notifications for 7 days, so your server has to detect duplicates.
    6. Launch with a small group and read the conversations every week.

    Privacy and telling people it's an AI

    Three minimums. First, tell the customer who processes their data and why, as article 13 of the GDPR requires, and sign processing agreements with anyone who handles the data on your behalf (article 28). Second, say it is an AI: article 50 of the AI Act, which applies from 2 August 2026, requires you to say so clearly at the latest at the first interaction, unless it is obvious. Third, choose a model provider that doesn't train on your data and, if you need processing in Europe, check its options: OpenAI has a European endpoint, and Anthropic's direct API currently offers global or US processing.

    There is more detail in the guide to WhatsApp AI chatbots.

    Common mistakes

    1. Registering a number that is still on the app. A number in use on WhatsApp can't be registered until that account is deleted.
    2. Forgetting the 24-hour window. The agent tries to reply with free text to someone who wrote two days ago, and the send fails.
    3. Putting a promotion in a utility template. Meta classes it as marketing.
    4. Splitting each reply into five messages. Each one counts as a service message, and the API only allows one message every 6 seconds to the same user on a sustained basis. Also, the delivery order isn't guaranteed: if it matters, wait for the delivery receipt before sending the next one.
    5. Not validating the webhook signature, or not detecting repeated notifications.
    6. Not storing the notifications. Meta doesn't offer an API for retrieving old webhooks: whatever you don't store is lost.
    7. Asking for data the policy prohibits, such as full payment card numbers or identity document numbers (WhatsApp policy).
    8. Letting the model improvise. Without data or limits, it makes things up. With specific tools and an instruction to hand over, it gets far fewer things wrong.
    9. Not saying it's an AI, when the AI Act already requires it.
    10. Using the temporary token in production. It expires and the agent stops replying.
    11. Launching without a payment method. The agent works up to the 1,000th service message of the month and then stops delivering.
    12. Thinking about the bot and not the team. If nobody picks up the handovers, the customer ends up worse off than before.

    How long it takes and what it costs

    The running cost has three parts: Meta's messages, the AI model's usage and maintenance. The first two are worked out with official rates in the pricing guide and in the chatbot guide. For what Meta will charge you each month, use our WhatsApp Business API cost calculator.

    If you would rather we built it, we start with a free assessment that takes 2 to 5 days and then give you a fixed price. A typical automation is up and running in 2 to 4 weeks. Our published prices, excluding VAT, are €1,500 to €6,000 for one automation workflow, €5,000 to €20,000 for several workflows and €4,000 to €12,000 for a first AI product. We do the work ourselves, without subcontracting, with data in the EU. The details are in AI solutions and process automation, with examples by sector for property managers and estate agents.

    Sources

    We check every article against primary sources before publishing it. If you spot a mistake, write to info@quantumnovaagency.com and we will correct it.

    Terms in this article

    Book your free diagnosis.

    Emailinfo@quantumnovaagency.comWhatsApp+34 678 428 710
    LocationTorrevieja (Alicante) · all of Spain

    What happens next

    1. 1We reply within 24 hours.
    2. 2We have a call to look at your case.
    3. 3We send you a proposal with a fixed price.

    By submitting this form you agree to your data being handled under the Privacy Policy.