WhatsApp sign-in (platform administration)
Manage the WhatsApp sign-in go-live gate (G3), kill switch, timed pre-access, walled garden host list, costs, KVKK Art. 9 transfer records and sign-in code templates.
WhatsApp sign-in is not yet available to customers
These screens are for the platform administrator's go-live preparation. WHATSAPP_ENABLED is off
by default on the server; until the checklist below is complete, the WhatsApp method does not
appear on any hotspot and guests receive their code by SMS.
The platform side of WhatsApp sign-in lives on three screens: WhatsApp (Platform) (status, controls, walled garden, cost), KVKK Art. 9 (WhatsApp) (cross-border transfer basis) and WhatsApp templates (Meta-approved sign-in code templates). All three are open to the platform administrator only, and every change is written to the audit log with its before / after values.
Go-live gate (G3)
The Go-live gate (G3) checklist shows the conditions the WhatsApp method needs. When a condition is missing, the reason is shown under its row:
- WHATSAPP_ENABLED is on: the operator turns it on in the server environment.
- Sendable platform number: the platform number or the customer's / reseller's own number.
- KVKK art. 9 cross-border transfer basis: a complete record on the KVKK Art. 9 screen.
- Per-client timed walled garden (6.6): timed pre-access on and at least one enabled host in the host list.
- Approved sign-in code template: see templates.
- Kill switch is off.
Until every condition is met, the WhatsApp method is not drawn on the portal and the portal designer refuses to save / publish a configuration with WhatsApp enabled. The Configuration status card shows the feature flag, the platform number, its quality rating and the template's language coverage.
Platform controls
On the Platform controls card:
- Kill switch (stop WhatsApp sending): when turned on (asks for confirmation), no
WhatsApp message is sent for any customer; the sign-in code goes by SMS in the same verification
and no pre-access is granted.
WHATSAPP_KILL_SWITCHin the server environment stops sending regardless of this switch. - Monthly message cap per customer: 0 means unlimited. Once the cap is reached, codes go by SMS. A customer-specific cap is set on the WhatsApp monthly cap card in Customer details. Messages sent from an own number have a separate cap.
- Timed pre-access (RouterOS v7): off by default. When a guest without mobile data asks for a code, the device gets at most 5 minutes of slow access to WhatsApp hosts only; access ends when the code is verified or the time runs out and is never extended. It works on RouterOS v7 only and needs a static upstream DNS server on the router; on RouterOS 6.49 the guest is sent to SMS. Turning it off removes the rules from routers in the background.
Walled garden host list
The Walled garden host list (WhatsApp) is the central list of domains (subdomains included) that timed pre-access opens. There are no static IP blocks and no permanent, unauthenticated WhatsApp access.
- Sources: Built-in (
whatsapp.net,whatsapp.com), Meta list (weekly refresh) and Admin. - Add host accepts names under
whatsapp.net,whatsapp.com,whatsapp.biz,wa.me,fbcdn.netandfbsbx.comonly. IP / CIDR entries and the shared Meta CDN roots themselves are rejected; add a specific subdomain instead (e.g.media.fbcdn.net). - Rows are never deleted, only enabled or disabled. Each service can have at most 20 enabled hosts.
- The weekly refresh runs every Monday at 03:37 and reads the list at
WHATSAPP_HOST_LIST_URL; it is skipped when the address is not set. A row no longer seen in the source is marked Not in source and disabled after 30 days. - When the enabled set changes, routers with WhatsApp enabled are reconfigured. The compliance check on the device's portal setup screen shows the rules on a device.
Cost
Monthly WhatsApp cost shows the message count and credits for the selected month per customer. Messages from the platform number are deducted from the customer's WhatsApp credit (net = deducted − refunded). Meta bills messages sent from an own number directly to that business's account; no platform credit is deducted.
KVKK Art. 9 cross-border transfer
In WhatsApp sign-in, the guest's phone number and code are transferred to Meta. The KVKK Art. 9 cross-border transfer screen selects and records the legal basis for the transfer:
| Basis | Guest | Required to enable |
|---|---|---|
| Standard contract (default) | No extra checkbox; an information notice opens | A complete standard contract record and the notice in the legal pack |
| Explicit consent | An unticked, separate, mandatory checkbox in the WhatsApp method only; guests who decline continue with SMS | The explicit consent text published in the legal pack |
- Choose the basis on the Transfer basis (platform) card and click Save basis.
- For the standard contract, use New contract record to enter the counterparty, the contract version, the signing date and the SHA-256 digest of the signed document. The document itself is not stored on the platform.
- Notify the Personal Data Protection Authority within 5 business days of signing and record the date and the document digest with Save notification.
- The deadline skips weekends and fixed public holidays; it does not skip religious holidays. A late notification is recorded but flagged with a warning.
- Records are never deleted and their signature fields cannot change. Close a wrong record with Revoke record and open a new one; without another complete record, WhatsApp sign-in closes.
- A customer-specific basis is selected on the WhatsApp: KVKK Art. 9 transfer basis card in Customer details. The customer's own Turn off WhatsApp sign-in switch takes precedence over any basis; only the customer changes it, the administrator only sees its state.
Sign-in code templates
WhatsApp templates shows the Meta approval status of each number's sign-in code template and its coverage in 8 languages. Submit 8 languages sends the template for approval and Sync from Meta fetches the status immediately; the status is also refreshed every hour at :17 and :47. In a rejected or paused language, the code falls back to a backup language or to SMS.
Own numbers and customer settings
Customers (when their package includes the own-number add-on) on the SMS page and resellers on the Profile page connect their own WhatsApp Business number with the Your own WhatsApp number card: they read the notice, choose I have read and accept and then Connect with Meta. Unless own-number connection is enabled separately on the server, the card shows "not available yet".
- Sending order: the customer's own number, the reseller's number if the customer allowed it (Codes may be sent from my reseller's WhatsApp number), the platform number, and finally SMS.
- An own number's quality, status and access permission are checked every 6 hours; if the number cannot be used, codes automatically go from the platform number or by SMS.
- In support access, the customer's WhatsApp switches and own-number actions (connect, disconnect) are not available; the customer does them personally.