About this plugin
Press Connect to Wakit and a window opens on Wakit. Put in your mobile
number, confirm the code that arrives on WhatsApp — an account is created there
and then if you do not have one — and choose which workspace pays for messages
and which approved template this site may send on. Approve, and the window
closes on your WordPress screen with the workspace, the balance and the template
already filled in.
Then:
- Templates. See every template you can send on, write a new one, and watch
it move from review to approved without leaving WordPress.
- Order notifications. When an order moves to Processing, Completed or any
other status, the customer gets a WhatsApp message. Each status picks its own
template and its own variables, built from merge tags like {full_name} and
{order_number}.
- Sign in with WhatsApp. A [wakit_otp_login] form takes a mobile number,
sends a code, and signs the matching account in. It also appears under the
php when wp-admin sign-in is switched on.
- Sign in to wp-admin with a mobile number. Switch on wp-admin sign-in and
administrators and shop managers can use the same form: number, code from
WhatsApp, straight to the screen they were asking for. Each of those accounts
puts its number on its own profile, under Sign in with WhatsApp.
- Your WhatsApp numbers. The dashboard shows the Cloud API numbers on your
Wakit workspace, which one your customers see the message arrive from, and
whether it can send today. Connect a new one on Wakit — the button gets you
there already signed in — and it appears here on the next look.
- Send log. Every attempt, successful or not, with what Meta said about
the failures.
Two kinds of account, and why the screens differ
You have your own WhatsApp Business number. You own that account, so every
template on it is yours, and a new one goes straight to WhatsApp for approval.
You are on Wakit’s shared number. You send from a number other businesses
also send from, so you use the templates Wakit has assigned to you — never
anybody else’s, and nobody else ever sees yours. A template you write is read by
Wakit before WhatsApp is shown it: on a shared number, WhatsApp holds everyone
to what any one of them sends.
What the site can and cannot do
This site can only send templates the workspace already has. Naming anything
else is refused by Wakit, not by the plugin — so a compromised WordPress install
cannot invent a message to send, and a plugin added here never widens what may
go out from a workspace.
The API key is swapped for on the server, never travels through a browser, and
php. A database dump on
its own is not a working credential.
External services
in), which is the service
that actually delivers the WhatsApp messages. Without a Wakit account the plugin
cannot send anything, so using this plugin means using that service.
in/api/v1 over
HTTPS, signed with the API key this site was given when you connected it.
- Connecting the site. Pressing “Connect to Wakit” opens
in/connect/authorize in a window and gives it this site’s
wp-admin address to come back to. When you approve there, the one-time code
that comes back is exchanged at /connect/exchange for an API key. Nothing
about your WordPress users is part of this step.
- Sending a WhatsApp message. When an order reaches a status you have
switched on, the plugin posts to /messages/template: the customer’s mobile
number in international format, the name of the approved template to send, and
the values you mapped into that template’s variables — usually the customer’s
name and the order’s number, total and status. A test send does the same with
the number you type in.
- Signing in with a code. The sign-in form posts the mobile number typed
into it to /otp/send, then that send’s id together with the code the visitor
typed to /otp/verify.
- Reading your account. The admin screens fetch /account, /connect/me,
/numbers and /templates for your wallet balance, the WhatsApp numbers on
your workspace and the templates you may send on. Writing a template posts its
name, language, category and text to /templates. Opening Wakit from a button
in wp-admin asks /connect/sso for a one-time signed-in link.
Nothing is sent anywhere until you connect the site, and no customer data is
sent until you switch on a feature that needs it.
- Tracked button links. When a template’s link button is
com/{{1}}, each send posts the destination (the order page,
the cart link or the campaign link — never the customer’s number) to
/short-links. Wakit makes that recipient’s own short link on 2xurl
com), which counts the clicks; the log reads the counts back
from /short-links. com
on the way to your page.
- Your own 2xurl account (optional). If you paste your own 2xurl.com API
key on the Short links screen, this site sends each link’s destination and
com/api/v1) with that key,
instead of through Wakit, and reads click counts back from it. The key is
stored encrypted on this site and is never sent to Wakit.
in/terms
in/privacy
com/terms
com/privacy