Official vs Unofficial WhatsApp API: the honest trade-offs

Quick answer: Use the official WhatsApp Cloud API for anything that must arrive — broadcasts to opted-in lists, one-time passcodes, Click-to-WhatsApp ads, and payment or medical messages — because it is a recoverable, contractually-backed business asset with guaranteed delivery. An unofficial API (Baileys, whatsapp-web.js) is cheaper and live in minutes, but it breaks WhatsApp's terms and risks a permanent ban, so it is only defensible for low-volume, customer-initiated support on a number you could afford to lose. Many businesses run both — official for infrastructure, unofficial for conversation.

Ask ten WhatsApp platform vendors about unofficial APIs and you will get ten versions of the same two sales pitches. Vendors built on the official Meta Cloud API will tell you unofficial integrations are reckless, doomed, and likely to get your number banned by Friday. Vendors built on unofficial libraries will tell you Meta's fees are a racket and the ban risk is overblown scare-mongering. Both are describing their own business model, not your decision.

We are in an unusual position to write this post. Remarketly supports both engines — the official Cloud API through a Business Solution Provider, and unofficial web-protocol automation in the family of Baileys and whatsapp-web.js. Tenants choose per number, and anyone connecting an unofficial number has to read and explicitly acknowledge the risks before the QR code even appears. We earn our keep either way, which means we have no incentive to exaggerate in either direction. Here are the trade-offs as plainly as we can state them.

What each one actually is

Official: the Meta Cloud API

The official route is the API Meta itself operates. Your number is registered as a business asset inside Meta Business Manager, usually through a certified BSP, and your software talks to it over REST and webhooks. Outbound messages outside the 24-hour service window must use pre-approved templates; conversations are billed by category; verified businesses can earn the green tick and run Click-to-WhatsApp ads. We covered the mechanics in our guide to the WhatsApp Business API, and the real per-conversation numbers live on our WhatsApp API pricing guide.

Unofficial: web-protocol automation

The unofficial route uses open-source libraries — Baileys, whatsapp-web.js, and their cousins — that speak the same protocol the WhatsApp Web client speaks. Your server pairs to a normal WhatsApp account as a linked device, exactly like linking a laptop. From that moment, software can read and send messages programmatically, and as far as WhatsApp's infrastructure is concerned, you are simply a very fast human at a keyboard.

One thing should be said before anything else: this violates WhatsApp's terms of service. Every honest conversation about unofficial APIs starts there. What follows is not a loophole or a clever grey area — it is a calculated risk that some businesses rationally choose to take. The question is whether you are one of them.

Official vs unofficial WhatsApp API: at a glance

The honest case for unofficial

Anyone who tells you unofficial integrations have no advantages is selling official-only software. The advantages are real:

• You are live in minutes, not days. No business verification, no Business Manager setup, no document uploads. Scan a QR code and your number is connected — the same afternoon you decided to try.
• It works with the number you already have. The consumer app keeps working on the phone, your existing chats stay intact, and the automation rides alongside as a linked device. The official API requires dedicating the number to the API — which kills the consumer app on that number permanently.
• There are no per-conversation fees. The marginal cost of a message is whatever your server costs. For a low-volume business doing two-way service conversations, the savings versus official conversation billing are genuine.
• No template approval cycle. You can send anything, any time, in any format — no waiting for Meta to review your wording, no rejected templates, no category disputes.
• It can see your history. An official number starts life blank. An unofficial session sees the years of customer conversations that already exist on the account — which matters enormously when you are importing an active business number into a CRM.

The honest case against it

And here is the other side, with no softening:

• Bans are real, and in practice unappealable. Meta runs behavioural detection — bulk sends of near-identical text, high-velocity messaging to people who never wrote to you first, link-heavy blasts from a fresh number. Trip it and the ban can be permanent, it takes the whole number with it, and there is no support line to call because you were never a customer. We have watched it happen.
• There is no SLA, and there never will be. These libraries reverse-engineer a protocol Meta changes whenever it likes. When a client update breaks the protocol, maintainers patch on volunteer time. Your channel can be down for hours or days, and nobody owes you anything.
• Sessions are fragile. Linked-device sessions drop. The phone goes offline too long, the session expires, someone has to re-scan a QR code while messages queue. Plan for it operationally, or be surprised by it at the worst possible time.
• It is unfit for OTP, payments, and regulated flows. Anything where a delayed or undelivered message has legal or financial consequences — one-time passcodes, payment confirmations, medical reminders, anything touching PDPL-aware data handling in the Gulf or BIR-compliant receipt flows in the Philippines — belongs on a contractually backed channel. Unofficial gives you no audit-grade delivery guarantees, because it gives you no guarantees at all.
• The collateral damage is personal. Because the session rides on a normal account, a ban does not just stop your automation — it takes out the number your customers memorised, the group chats, the years of history, and whatever else lived on that account. Businesses rarely price that in until the day it happens.

When official is non-negotiable

There are five situations where, in our view, the unofficial route is not a discount — it is a mistake:

1. Broadcasts at any real scale. Marketing to opted-in lists is exactly what official template messaging is built for, with sending tiers that grow as your quality rating proves out. Doing the same thing through an unofficial session is the single fastest known route to a ban.
2. Click-to-WhatsApp ads. CTWA campaigns can only land on an official number. If paid social is part of your funnel, the decision is already made for you.
3. Authentication and OTP. Verification codes need guaranteed delivery and a provider who answers when something breaks. Full stop.
4. Brand trust at the top of the funnel. The green verification tick measurably changes how strangers treat your first message. Only official numbers can earn it.
5. Business continuity. An official number is a registered, recoverable business asset. An unofficial session is, structurally, a phone in a drawer that must never run out of battery. Ask yourself which one your revenue should depend on.

A simple decision framework

Strip away the vendor noise and the decision usually comes down to five questions:

1. Would a one-week outage on this number damage the business? If yes, official.
2. Are you messaging people who have not messaged you first? If yes, official — this one is not negotiable.
3. Is the content financial, medical, or identity-related? If yes, official.
4. Is this a low-volume inbound number — one team answering questions customers send first? Unofficial is defensible here, eyes open.
5. Are you still testing whether WhatsApp matters for your business at all? Unofficial is honest prototyping — as long as you plan the migration before the experiment succeeds.

Our shorthand: unofficial is for conversations; official is for infrastructure. A human-paced, customer-initiated support line is a conversation. Broadcasts, OTP, ads, and anything a regulator might one day ask about is infrastructure.

The hybrid pattern nobody talks about

There is a third answer that vendor marketing ignores because it does not fit neatly on a pricing page: run both. Plenty of real businesses keep two numbers with two different jobs. The official number carries the infrastructure — broadcasts to opted-in lists, Click-to-WhatsApp campaigns, order confirmations, anything that must arrive. The legacy number — the one printed on five years of business cards and saved in a thousand customers' phones — stays on an unofficial engine answering inbound chats, because porting it to the API would wipe its history and confuse everyone who already has it saved.

Done deliberately, this is not indecision; it is risk allocation. The revenue-critical traffic sits on the channel with a contract behind it, and the long tail of casual conversation keeps the number people actually know. The mistake is drifting into this setup by accident and never writing down which number is allowed to do what.

How Remarketly handles both

We built the platform so the engine is a per-number choice, not an identity. The AI agent, the smart inbox, the CRM funnels, loyalty, and paperless receipts all sit one layer above the transport — they neither know nor care which engine carried the message.

• Explicit, plain-language risk acknowledgment. Before an unofficial number can connect, the owner reads essentially what you just read — ban risk, no SLA, unfit for regulated use — and actively accepts it. Not a checkbox buried in the terms. If a vendor ever connects you to an unofficial engine without telling you which engine you are on, leave.
• Guardrails by design. Heavy broadcast tooling stays on the official engine. We are not interested in helping anyone speed-run a ban.
• A real migration path. Because contacts, tags, funnels, and automations live above the engine, graduating a number from unofficial to official is a connection change, not a rebuild. Verify the number with the BSP, flip the engine, keep everything else.

That last point matters more than it sounds. The pattern we see most often — a salon, a clinic, a small retailer — starts on an unofficial number to prove WhatsApp works for the business at all, then graduates to official the month they want broadcast campaigns or ad traffic. One owner put it to us memorably: “Unofficial was the rental. Official is the mortgage.”

Frequently asked questions

Can WhatsApp ban you for using an unofficial API?

Yes. Unofficial APIs (Baileys, whatsapp-web.js) violate WhatsApp's terms of service, and Meta's behavioural detection can permanently ban the number — especially for bulk or unsolicited sends. The ban usually takes the whole account, with no appeal. Low-volume, customer-initiated replies are far lower risk than broadcasts.

Is the official WhatsApp Cloud API free?

The Cloud API itself has no platform fee, but Meta charges per conversation/message by category (marketing, utility, authentication, service), and the rate varies by the recipient's country. See our WhatsApp API pricing guide for current numbers — and note that a good BSP passes Meta's fee through at cost, with no markup.

Can I use my existing WhatsApp number with the official API?

Only by migrating it — and migrating a number to the Cloud API permanently disables the consumer WhatsApp app on it and does not carry over old chat history. Many businesses keep their well-known legacy number on an unofficial engine for inbound chat and use a separate official number for broadcasts and ads.

What is the difference between the WhatsApp Business app, the Cloud API, and an unofficial API?

The free WhatsApp Business app is for manual use on one phone. The Cloud API is Meta's official programmatic channel for automation, broadcasts and integrations at scale. An unofficial API reverse-engineers the WhatsApp Web protocol to automate a normal account — faster and cheaper, but against the rules and ban-prone.

Official vs unofficial: which should a small business choose?

If a one-week outage would damage the business, you message people who did not write to you first, or the content is financial or medical — choose official. For a single team answering inbound questions on a number you could replace, unofficial is defensible with eyes open. When in doubt, start unofficial to validate, then graduate to official before you scale broadcasts or ads.

Closing

The quiet dishonesty in this market is pretending the choice does not exist — official-only vendors who never explain why half their prospects hesitate at template pricing, and grey-market tools that never utter the word ban. You deserve the whole map: two engines, different jobs, real trade-offs, and a migration path between them.

If you want to see what the official side actually costs before you decide, the numbers are on our WhatsApp API pricing guide. And when you are ready to run either engine — or both — behind one inbox, one CRM, and one AI agent, join the waitlist and we will set you up with eyes open.