WhatsApp

WhatsApp is a second channel on the same application thread, for candidates already in your pipeline. Email stays the system of record — it carries the calendar invite, it is the candidate's identity, and it always sends. Rejections never go over WhatsApp, and neither does outreach, marketing or SMS.

Before you start#

Plan a week. Almost all the work is on Meta's side, and two stages run on Meta's calendar rather than yours: business verification, and up to 24 hours of review per template. Email works from the first minute and depends on none of it.

There is no hosted onboarding — you bring your own Meta credentials, because Embedded Signup requires Tech Provider status we do not have. Krinoa then talks to the Graph API directly over HTTPS, pinned to v25.0 by default, with no vendor in between: no Twilio, no 360dialog. Get four things from Meta first:

1. A Meta business portfolio, and a Meta app with the WhatsApp product added.
2. A WhatsApp Business Account (WABA) and a phone number that is not on consumer WhatsApp.
3. A System User with a permanent access token, holding whatsapp_business_messaging and whatsapp_business_management.
4. The app's App secret, from the app's Basic settings.

A brand-new Meta app comes with a free test number that reaches a handful of recipients and needs no business verification — enough to try the whole flow end to end before you commit a real number.

Connect your number#

1. In Settings › Integrations › WhatsApp, fill in the Phone number ID and WABA ID (both from WhatsApp › API setup in your Meta app), the Access token (the System User token), the App secret, and the Template language every template is submitted in, like en or en_US. Save.
2. Copy the two strings the connected card now shows, each with a copy button: the Callback URL, https://app.krinoa.com/api/inbound/whatsapp/<channel id>, and the Verify token Krinoa generated for this channel.
3. Paste both into your Meta app › WhatsApp › Configuration, and subscribe to messages and message_template_status_update.

Each channel has its own URL, verify token and app secret; the webhook signature is checked against that channel's secret. The token and app secret are sealed at rest with AES-256-GCM and never returned by the API, so rotating means pasting new values. Disconnecting removes the credentials and cancels every queued WhatsApp message; templates and consent records are kept.

How a candidate opts in#

Meta requires opt-in before any business-initiated message. There are exactly three ways a candidate gives it:

• The apply form checkbox, shown when the phone field is on the form and your workspace has a connected channel.
• You record it on the packet, with a note saying how they agreed.
• They message you first.

Each writes a whatsapp.consent entry to the ledger with its source. Phone numbers are normalised to E.164 at every intake — the apply form, Add candidate, and the CLI. A candidate with no number cannot be reached here.

Opting out#

A candidate whose whole message is STOP or UNSUBSCRIBE (case-insensitive) is opted out immediately, their queued messages are cancelled, and they get one plain confirmation line. START or SUBSCRIBE opts back in; until then no template of any kind goes out. A send that permanently fails because the number is not on WhatsApp marks the candidate unreachable.

Write the WhatsApp bodies#

Every WhatsApp template is a variant of a template you already have, edited in the WhatsApp body block beneath the email body under Settings › Templates. Seven keys can carry one: application.received, interview.proposed, interview.confirmed, interview.rescheduled, interview.cancelled, interview.reminder and whatsapp.nudge. Their buttons are fixed per key and not editable — the button ids are what the inbound handler acts on.

A WhatsApp body is plain text with the same {{variable}} whitelist as its email twin, plus three rules the editor enforces before you can save:

• At most 1024 characters.
• No promotional wording. Words like opportunity, offer, apply now, limited, free or exclusive are refused — a utility template that drifts into marketing gets re-categorised by Meta, and marketing templates are not delivered to US numbers at all.
• It must include {{org.name}}. Every first message says who is writing, because job scams look exactly like this.

Get templates approved#

Sync on the Integrations card submits the changed bodies to Meta as UTILITY templates and refreshes the review state of the rest: Draft, In review, Approved, Rejected (with Meta's reason), Paused or Disabled. Review takes up to 24 hours, sometimes longer, and a rejection means editing and resubmitting.

Editing an approved body creates the next version, and the previous approved version keeps sending until the new one clears review — so an edit never takes the channel down.

The 24-hour window#

Meta only allows free-form messages inside a 24-hour customer-service window, which opens and resets every time the candidate messages you. The window belongs to the candidate's phone number, not to one application — two applications from the same person share it. Outside it you can only send an approved template; whatsapp.nudge is the one whose job is to ask the candidate to reply so the window reopens.

What it costs#

Meta bills you directly, per delivered message, by template category and destination country. Krinoa does not bill for messages and does not mark them up. The Integrations card counts what went out this month by pricing category, from the data Meta returns on every status webhook — a count, not an invoice.

Two dates worth knowing: service messages have been free since November 2024, and from 1 October 2026 service messages and utility templates sent inside an open window become billable at the destination country's utility rate.

Limits Meta sets#

• Unverified, you can reach 250 unique recipients per rolling 24 hours. Business verification lifts that to 2,000, and the tiers go up from there.
• Marketing templates are not delivered to US numbers, which is why every Krinoa template is utility.
• There is no SMS fallback. If WhatsApp cannot deliver, email does.

What a candidate's messages and phone number are kept for is in Data and privacy.