Developer API
Send WhatsApp templates from your own backend, and get signed events back when something happens. Server-to-server, key-authenticated.
Send a campaign
One approved template to one number, from your order system, your CRM, or a cron job.
curl -X POST https://www.grownextai.com/api/v1/campaigns/send \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"campaignName": "order-confirmed",
"destination": "919876543210",
"userName": "Priya",
"templateParams": ["ORD-1042", "Tuesday"]
}'The key may also be sent as x-api-key, or as apiKey in the body — though the header is preferable, because request bodies get logged.
Receive events
A signed POST to your endpoint the moment a customer writes, or a message changes state.
POST https://your-server.example/hooks/grownext
X-GrowNext-Signature: t=1790000000,v1=9f86d0818...
{
"id": "evt_msg_01J...",
"event": "message.received",
"createdAt": "2026-09-30T08:14:02.000Z",
"data": { "from": "919876543210", "text": "Is this in stock?" }
}message.received — Someone sent a message to your WhatsApp number.message.status — A message you sent was accepted, delivered, read or failed.lead.created — A new lead was added to your CRM — from WhatsApp, Instagram, ads, your website chatbot, a form or by hand.lead.stage_changed — A lead moved to a different pipeline stage, e.g. Contacted → Won.order.received — A customer sent a cart from your WhatsApp catalogue — items, quantities and total.What you can rely on
The parts that decide whether an integration survives a bad afternoon.
Signed payloads
Every webhook carries an HMAC-SHA256 signature over a timestamp and the raw body, so you can verify it came from us and is not a replay. Compare it in constant time.
Retries that give up sensibly
Anything that does not return a 2xx is retried up to 6 times over about 103 minutes, backing off at 30s, 2m, 10m, 30m, 60m. A deploy that takes your server down for a minute loses nothing.
Stable event ids
A retry carries the same id as the first attempt, so you can make your handler idempotent rather than guessing whether you have seen an event before.
Rate limits you can plan around
20 requests per 1s on a sliding window, with a body cap of 64 KB. Exceeding it returns a 429, not a silent drop.
Keys you can revoke
Keys are stored hashed and shown once. Each is named, shows when it was last used, and can be revoked on its own without disturbing the others.
A log of every call
Successful and rejected, with the reason. When an integration stops working, the answer is on a screen rather than in a support thread.
Moving from another provider
The send endpoint accepts AiSensy's field names — campaignName, destination, userName, templateParams — so an existing integration usually switches by changing the URL and the key, and nothing else.
There are deliberately no CORS headers on the API: it is server-to-server. Calling it from a browser would mean shipping your key to every visitor.
Getting a key
API keys are created in the app under Settings, and event webhooks are configured on the Webhooks screen — available on the Agency plan. Both are per business, so an agency managing several keeps them separate.
See which plan includes what →