Migrating in two lines

Moving an existing WhatsApp Cloud API integration onto Cosend — the hostname, the token, and the two things that are deliberately not identical.

If you already call Meta’s Graph API — directly, or through a provider that proxies it — the migration is two lines.

- https://graph.facebook.com/v26.0/123456789/messages
+ https://api.cosend.app/v26.0/123456789/messages
- Authorization: Bearer <META_ACCESS_TOKEN>
+ Authorization: Bearer csk_live_<...>

Paths, payloads, status codes and error envelopes are unchanged, and your version pin comes with you: send v25.0 and we forward v25.0.

That is the whole change. What follows is the part nobody else writes down.

Two things are not identical

An undocumented difference in a compatibility layer is worse than a documented one. Someone who discovers the first of these in production stops believing the rest of the page — so both are here, in the first screen, rather than in a footnote.

1. GET /{MEDIA} returns a rewritten URL

Meta’s media endpoint answers with a url on lookaside.fbsbx.com, and that URL is signed for a token your Cosend key is not. So the url we return points at api.cosend.app instead, and fetching it with your Cosend key works.

Everything else in the response is Meta’s. If your code reads url and fetches it with the same bearer it used for the metadata call — which is what Meta’s own examples do — nothing changes for you at all.

2. The allowlist is a list

We proxy an allowlisted set of paths, and an unlisted one returns 404 in Meta’s envelope. Six families are refused, each with a stated reason and a stated condition for re-entry.

Check your integration against the coverage table before you switch the hostname, not after. It is nineteen rows and it takes a minute, and it is the one thing that can make this migration take longer than the two lines suggest.

What you gain by the change

Nothing you have to do, but worth knowing it is happening:

• appsecret_proof is computed for you on every call. You stop holding an app secret.
• Every proxied send is recorded, so the shared inbox, the conversation history and the automations fill up from traffic you were already sending.
• Rate limiting, per connection and per key, in front of Meta’s — so a runaway loop hits our limiter and a 429 you can read rather than a quality-rating problem you find out about later.

What does not change

Your WhatsApp Business Account, your number, your templates and your Meta billing relationship. Meta bills you directly at Meta’s rates. We do not mark them up, resell them or hold your message credit.

If you are coming from another provider, the disconnection from them happens in the WhatsApp Business app’s own settings — Meta’s screen, not theirs and not ours.

Before you switch production

1. Point a csk_test_ key at a test connection and run your existing suite against it. The credential is the mode; there is no header to set.
2. Check the error reference for the codes your retry logic branches on. /v1 codes are ours and stable; on the passthrough you keep getting Meta’s, with the original always present.
3. Move one number first. Connections are independent, so there is no all-or-nothing cutover.