OpenWA: A Free Self-Hosted WhatsApp API for Automation and Notifications

Server alerts that only arrive by email are often read too late. WhatsApp, on the other hand, is an app you almost certainly open every hour. OpenWA bridges the two: a WhatsApp API gateway you run yourself, so scripts, cron jobs, or automation flows can send WhatsApp messages to your number — no paid middleman, no per-message fee.

OpenWA is built with Node.js/NestJS and provides a REST API, a web dashboard, multi-session support (several numbers in one installation), webhooks for incoming messages, and a Swagger UI for trying the API. Its default database is SQLite, with PostgreSQL and Redis as options for heavier use. Everything runs on your server, so message contents never pass through a third-party server.

An honest warning: this is NOT the official WhatsApp API — your number can be blocked

Read this section before connecting any number.

OpenWA works through WhatsApp Web automation (the whatsapp-web.js engine by default, with baileys as an alternative). That is not Meta's official WhatsApp Business API. WhatsApp's terms prohibit unofficial automation, and a number used for this kind of automation can be blocked, temporarily or permanently — even if you only send notifications to yourself.

Consequences:

Don't connect your main number. Use a second number you can afford to lose access to.
Don't send spam or bulk messages. High volume and bot-like patterns get you blocked faster.
Don't rely on it for anything business-critical. If a notification involves money or safety, use Meta's official WhatsApp Business API or another official channel, even if it costs money.
Don't promise anyone "100% safe" — including yourself. No unofficial gateway can guarantee that.

With that understood, OpenWA remains a sensible tool for personal notifications, testing, and small-scale automation on a second number.

Step 1: Install OpenWA with Docker

You only need Docker and Git on your Ubuntu server. The commands below follow the project's current official README — note that old tutorials use port 3000, while the current version uses port 2785. If you copy commands from an old tutorial, you'll open the wrong port.

git clone https://github.com/rmyndharis/OpenWA.git
cd OpenWA
docker compose -f docker-compose.dev.yml up -d

Once the containers are running, three addresses are live on your server:

Dashboard: http://localhost:2785
API: http://localhost:2785/api
Swagger UI: http://localhost:2785/api/docs

On first boot, OpenWA generates an admin API key, prints it once in the log, and stores it at /app/data/.api-key inside the container. Retrieve it with:

docker exec openwa-api cat /app/data/.api-key

The key has no trailing newline, so your shell prompt will stick right after the key — copy only the key itself. Later boots only show a masked key prefix, so store this key carefully. The key is used to log in to the dashboard and as the X-API-Key header on every API call. Treat it like a password.

Step 2: Connect your second WhatsApp number

Open the dashboard at http://localhost:2785 — since the port only listens on the server, reach it via an SSH tunnel from your laptop, or through an HTTPS reverse proxy if you already have one set up. Scan the QR code shown with the WhatsApp app on your second number's phone, exactly like linking WhatsApp Web.

The linked session is stored in /app/data inside the container, which the production Compose file maps to a Docker volume named openwa-data. That means: backing up that volume backs up the session and history; deleting it means scanning the QR code again. Never delete this volume by accident.

Step 3: Send your first message and hook up automation

Open the Swagger UI at http://localhost:2785/api/docs. There you can view and try the message-sending endpoints with the X-API-Key header — send one test message to your own number before building anything on top of it.

Once the test message arrives, the most useful automation patterns combine OpenWA with tools you already have:

Uptime Kuma → OpenWA: when the monitor detects a server down, a webhook triggers a WhatsApp message to you. Much faster to notice than email.
n8n → OpenWA: an n8n flow with an HTTP Request node carrying the X-API-Key header can send daily log summaries, backup reports, or cron warnings.
Shell scripts/cron → OpenWA: a backup script that fails at midnight can tell you right away, instead of being discovered the next morning.

One design principle: automation messages should be rare and important. Notifications flooding in every minute will get ignored — and aggressive sending patterns also raise the risk of your number being blocked.

Securing your installation

An OpenWA instance exposed raw to the internet is an open invitation: anyone who finds the port can use your number to send messages.

Don't expose port 2785 directly to the internet. Access it via an SSH tunnel, or via an HTTPS reverse proxy with authentication.
Keep the API key out of the repository and never commit a .env file containing the key.
Limit who can reach the dashboard — ideally only you, via a VPN or private network.
Back up the openwa-data volume as part of your regular server backups.

OpenWA vs. the official API and paid gateways

Aspect	OpenWA (self-host)	WhatsApp Business API (Meta, official)	Paid gateway
Cost	Free (besides VPS cost)	Per conversation, per Meta's rates	Per message / subscription
Official status	Unofficial — number-block risk	Official, supported by Meta	Usually uses the official API
Data control	Full, on your server	Through Meta's infrastructure	Through the provider's server
Best for	Personal notifications, testing, small scale	Business and critical messages	Businesses that need to move fast
Requirements	Second number, Docker, willingness to accept risk	Business verification, dedicated number	Sign up and pay

Checklist before you finish

OpenWA running via Docker and the dashboard reachable on port 2785
Admin API key stored safely outside the repository
The connected number is a second number, not your main one
One test message sent and received before automation is built
Port 2785 not exposed raw to the internet
The openwa-data volume included in the backup schedule
Usage limited to important notifications, not bulk messages

Once everything is ticked off, you have a WhatsApp notification channel living on your own server — free, under your control, and with its risks understood from the start.

What server notification would you want landing in your WhatsApp? Tell us in the comments — and if you already use OpenWA, which flow has most often saved you from finding out too late?

Cari Blog Ini