WhatsApp Business API: direct vs BSP — the real cost in 2026

For most businesses building a WhatsApp integration in 2026 the answer is the direct WhatsApp Cloud API from Meta. It is free to use, has the lowest per-conversation cost, and gives you full control over message templates and verification. BSPs (Business Solution Providers) like Twilio, MessageBird, and Vonage are worth their markup only if you need their value-add — a built-in chat UI, multi-channel routing, regulatory compliance you don't want to handle, or call-center integration. The vast majority of teams pay BSP fees for "easier setup" and discover six months in that they're spending $2-3k per month on what would have cost $200 directly from Meta.

We've shipped WhatsApp integrations both ways for clients. This is the honest breakdown.

What you're actually paying for

The WhatsApp cost stack has three layers:

1. Meta's per-conversation fee — billed by Meta regardless of which path you take. ~$0.005 to $0.12 per conversation depending on country and conversation category.
2. API access fees — Meta charges nothing for direct Cloud API. BSPs charge a markup per conversation (typically 50-200% of Meta's rate) plus a monthly fee.
3. Your own engineering / ops cost — building the integration, managing templates, handling webhooks, dealing with the Meta Business verification.

A BSP's pitch is that they absorb layer 3 in exchange for a higher layer 2. Whether that trade-off is good depends on what you're building.

When direct Cloud API wins

You should use the direct Meta WhatsApp Cloud API if:

• You're an engineering team comfortable with HTTP webhooks and OAuth flows
• Your volume is >5k conversations per month (BSP markup adds up fast)
• You want to control message templates yourself
• You don't need multi-channel (SMS + WhatsApp + email) in one platform
• You want to ship a custom support UI, not use someone else's

This is most B2B SaaS, most e-commerce, most bot-first products.

When a BSP wins

Use a BSP if:

• You need the message volume but don't have engineering bandwidth to manage the integration
• You're a non-technical team using a SaaS-style WhatsApp inbox (Zendesk, Front, Intercom integration)
• You need WhatsApp + SMS + voice unified into one API
• Your industry has specific compliance requirements you'd rather outsource (telecom, banking, government)

For most builders this is the minority case.

The real numbers

Take a mid-sized SaaS sending 50k notifications and handling 10k user-initiated conversations per month.

Direct Cloud API:

• Meta fees: ~$50-200/month depending on country mix (utility templates are cheap, marketing templates are not)
• Hosting your webhook: ~$20/month
• Engineering: ~1-2 days to wire up, then negligible
• Total: ~$250/month

BSP (Twilio Conversations):

• Twilio per-message fee: ~$0.005/inbound + Twilio's WhatsApp markup
• Twilio monthly platform fee: $0-200 depending on plan
• Meta fees: same as above, passed through
• Total: ~$1500-3000/month for the same volume

The difference is real money. We had a customer migrate off Twilio to direct Cloud API last year and cut their WhatsApp bill by 85%.

Getting onto the direct Cloud API

The setup is no longer the nightmare it was in 2022. Three steps:

1. Create a Meta Business account and verify it
2. Create a WhatsApp Business app at developers.facebook.com
3. Add a phone number and request production access

The verification step takes 2-7 business days. Have your business registration documents ready. After verification, you get a permanent access token and you can send to any phone number worldwide.

// Minimal "send a template message" call
const response = await fetch(
  `https://graph.facebook.com/v21.0/${PHONE_NUMBER_ID}/messages`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${ACCESS_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      messaging_product: "whatsapp",
      to: "+447700900100",
      type: "template",
      template: {
        name: "order_confirmation",
        language: { code: "en_GB" },
        components: [
          {
            type: "body",
            parameters: [
              { type: "text", text: "Alex" },
              { type: "text", text: "#A293" },
            ],
          },
        ],
      },
    }),
  },
);

The webhook side

Inbound messages arrive at the URL you configure in the WhatsApp app dashboard. Meta verifies the URL with a GET request, then POSTs message events.

// src/app/api/whatsapp/webhook/route.ts
import crypto from "node:crypto";

// 1. Verification handshake
export async function GET(req: Request) {
  const { searchParams } = new URL(req.url);
  if (
    searchParams.get("hub.mode") === "subscribe" &&
    searchParams.get("hub.verify_token") === process.env.WA_VERIFY_TOKEN
  ) {
    return new Response(searchParams.get("hub.challenge"));
  }
  return new Response("forbidden", { status: 403 });
}

// 2. Event delivery
export async function POST(req: Request) {
  const raw = await req.text();
  const sig = req.headers.get("x-hub-signature-256")?.replace("sha256=", "");
  const expected = crypto
    .createHmac("sha256", process.env.WA_APP_SECRET!)
    .update(raw)
    .digest("hex");
  if (sig !== expected) return new Response("invalid", { status: 401 });

  const body = JSON.parse(raw);
  for (const entry of body.entry ?? []) {
    for (const change of entry.changes ?? []) {
      const messages = change.value?.messages ?? [];
      for (const msg of messages) {
        await handleMessage(msg); // idempotency key on msg.id
      }
    }
  }
  return new Response("ok");
}

Same idempotency rule applies — Meta will retry. Use msg.id as your dedup key. See webhook idempotency is the bug most teams ship for the pattern.

Templates — the part everyone misunderstands

WhatsApp distinguishes between:

• Session messages — replies sent within 24 hours of a user's last inbound message. Free-form text allowed. Cheap.
• Template messages — outbound messages sent outside the 24h window, or any first message to a user. Must use a pre-approved template. More expensive.

If you want to send a notification to a user who hasn't messaged you recently, you must use a template. Templates require review by Meta — turnaround is usually 24-48 hours.

Template categories (set at submission time) determine pricing:

• Utility — order updates, appointment reminders. Cheapest tier.
• Marketing — promotional content. Most expensive tier, sometimes 10x utility cost.
• Authentication — OTP codes. Cheap and high deliverability.

Mis-categorizing your template (sending marketing as utility) is the fastest way to get your account suspended. Meta does enforce.

Conversation pricing math

Conversations are charged in 24-hour windows from the first message. One conversation can contain hundreds of messages. The per-conversation cost varies wildly by country:

• US/UK: ~$0.005-0.04 per conversation (utility/marketing)
• India: ~$0.001-0.01 per conversation
• Brazil: ~$0.005-0.05 per conversation

Conversation type matters more than message volume. A user who opens a long support thread is one conversation. A bulk announcement to 10,000 users is 10,000 conversations.

For high-volume marketing this can be a lot of money. Always model conversation pricing before committing — Meta's rate card changes ~annually and not always in your favor.

Rate limits and tier progression

New accounts start at 1000 unique destinations per 24 hours. You progress through tiers as you send quality (low-block-rate) messages: 1k → 10k → 100k → unlimited. The first jump (1k → 10k) takes ~3-7 days of steady sending. The unlimited tier requires several weeks of clean usage.

Plan for this. If you launch a marketing campaign on day 1 expecting to hit 50k recipients, you will hit the cap at message #1001 and frustrated customers will fill your support inbox.

Multi-number, multi-line WhatsApp

Each phone number is its own messaging surface. You can attach multiple numbers to one Meta Business Account — useful if you operate in multiple countries and want each to have a local number. They're billed separately and have separate tier progressions.

Common production gotchas

A short list of mistakes we've fixed at customer sites:

• Webhooks not deduplicated → duplicate replies fired to users
• Template parameters with newlines → Meta returns a cryptic 400, took two hours to debug
• Phone numbers without + country code → silent delivery failure
• Forgetting to handle messages.statuses events → no read/delivered tracking
• Storing the verify token in code instead of env → leaked on a public repo
• Not handling messages.errors → silent failures in production

Choosing between BSPs if you go that way

If you do go BSP, the three serious options:

• Twilio — most mature API, highest markup, best multi-channel
• MessageBird — better pricing in Europe, decent docs
• Vonage — strong in voice, weaker pure-WhatsApp

We've shipped Twilio integrations and recommend it if you need their multi-channel features (SMS + WhatsApp + email under one provider) or compliance support. For pure WhatsApp at scale, direct Cloud API beats them all on cost.

FAQ

Can a small business use the direct Cloud API?

Yes. Meta does require business verification but a small registered business (LLC, Ltd, sole prop) can complete it. The 1000/day starting tier is enough for most early-stage use.

What's the difference between Cloud API and on-premise API?

Meta deprecated the on-premise API. Cloud API is the only path forward.

Do I need a dedicated WhatsApp phone number?

Yes. The number you attach to the WhatsApp Business Account cannot also be used in the consumer WhatsApp app. Plan for a dedicated business line.

Can I send to any phone number worldwide?

Yes, with one caveat — the recipient must have WhatsApp installed. There's no way to know in advance whether a number has WhatsApp; you discover at send time when the API responds.

Are there messaging limits per user?

No hard per-user limit, but Meta tracks block rates aggressively. Users blocking your business is the single biggest cause of tier downgrades.

What about voice calls?

WhatsApp added business calling in 2024. It's separate from messaging in pricing and is still rolling out by country. Don't plan on it for global use yet.

Can I use WhatsApp for OTP delivery?

Yes — the "authentication" template category exists for this. Often cheaper and more deliverable than SMS in countries with poor SMS infrastructure.

What's the customer-care window?

24 hours from the user's last inbound message. Inside the window, free-form replies are allowed at session-message rates. Outside, you must use templates.