// the take
A self-hosted REST API and dashboard that wraps Baileys (the reverse-engineered WhatsApp Web client) to let you run multiple WhatsApp sessions, schedule messages, auto-reply on keywords, and push events out via webhooks. Built for developers who want to bolt WhatsApp messaging into their own apps or n8n workflows without paying for the official WhatsApp Business API.
The API surface is genuinely wide (100+ documented endpoints covering sessions, groups, labels, contacts, broadcast, and webhooks) with a real Swagger UI at /docs rather than just a markdown table that drifts out of date. The n8n action/trigger node package is a smart distribution move since it puts this in front of no-code users who'd never touch a REST client directly. Auth basics are handled correctly: bcrypt for passwords, Zod validation on inputs, and RBAC with SUPERADMIN/STAFF/USER roles instead of a single flat admin account.
Everything here rides on Baileys, an unofficial protocol implementation — WhatsApp can and does break these clients with no notice, and using them commercially risks number bans, which is a structural risk no amount of code quality fixes. The README itself flags the status-update endpoint as broken in production, which is a bad sign to ship a known-broken route rather than hide it behind a feature flag until it works. Broadcast relies on randomized 10-30s delays for anti-ban rather than a real queue with backpressure, so it won't hold up under any serious send volume and offers no retry/dead-letter handling if WhatsApp rate-limits mid-batch. There's no mention of how multi-session state survives a restart or scales across more than one process — Baileys sessions are inherently stateful single-connection sockets, and the docs don't address horizontal scaling or session migration at all.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →