Multi-Tenancy

Whatbot is multi-tenant: each workspace (tenant) is fully isolated — its own number, contacts, conversations, templates, agents, and API keys.

One workspace = one WhatsApp number

Each workspace sends from its own WhatsApp Business number, resolved per-request. Two workspaces never share a number, an inbox, or a contact list.

API keys are scoped to a workspace

An API key (wa_live_…) belongs to exactly one workspace. Every call it makes reads and writes only that workspace’s data — there’s no cross-tenant access. Keys are stored hashed and can be revoked/rotated any time.

Own number

Per-workspace WhatsApp number + WABA.

Own templates

Templates come from that workspace’s WABA.

Own contacts & inbox

Data is filtered by workspace on every query.

Own API key

Scoped credential; can’t reach other workspaces.

Tokens: shared vs per-tenant

• Bring-your-own-WABA (Embedded Signup): the workspace stores its own token (encrypted at rest) and uses it for all its WhatsApp calls.
• Shared-business numbers: numbers under one business can be managed with a single system-user token; the workspace just resolves the right phone number id.

For solution partners

Onboarding is a one-time step per client (Embedded Signup or asset-sharing). After that, a single system-user token can manage every client WABA shared to your business — you don’t fetch a token per message. See WhatsApp Setup.