Your app, connected.
The implementation guide.

01. Connection and personal key

Create or sign in to an Enlazá account, connect WhatsApp Business and open Personal keys. Create a named key with the permissions you need. Copy it when created: it will not be shown again. Up to ten active keys per account. Use one per integration. Store it as a server secret, never in a URL, repository, browser storage or chat message.

Server: https://enlaza.chat/mcp. Authentication: Authorization: Bearer <personal key>. If a form asks for the key alone, paste the secret without Bearer. The key authenticates access; it does not connect your number or create a notification subscription.

02. First read with JSON-RPC

Prefer a maintained MCP client that negotiates protocol versions and handles JSON or SSE responses. The example shows the initial contract; replace the placeholder using a server-side secret. If the server returns a session identifier, retain MCP-Session-Id in subsequent requests. Send each JSON-RPC object in a separate POST, not as a batch. Retain the negotiated version header on subsequent requests.

POST /mcp HTTP/1.1
Host: enlaza.chat
Authorization: Bearer <ENLAZA_PERSONAL_KEY>
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2025-11-25

{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"my-business-app","version":"1.0.0"}}}

After initialize, send notifications/initialized, call tools/list, then whatsapp_accounts. Use the actual ID of your own number; ready and webhook_ready indicate readiness, not proof of a received message. Then call whatsapp_messages with that connection_id. Results depend on permissions and number status.

{
  "jsonrpc": "2.0",
  "method": "notifications/initialized"
}

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/list",
  "params": {}
}

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "whatsapp_accounts",
    "arguments": {}
  }
}

{
  "jsonrpc": "2.0",
  "id": 4,
  "method": "tools/call",
  "params": {
    "name": "whatsapp_messages",
    "arguments": {
      "connection_id": "<ID_FROM_WHATSAPP_ACCOUNTS>"
    }
  }
}

03. Permissions and tasks

Discover each tool’s actual schema with tools/list before calling it. whatsapp_messages paginates up to 50 messages and returns next_cursor where applicable. whatsapp_media retrieves available attachments; whatsapp_transcription retrieves or requests transcripts in the account’s selected audio language: Spanish, Portuguese or English. A German translation of the website does not add German transcription.

Use whatsapp_send_text, whatsapp_send_image or whatsapp_send_document following the discovered schema. Generate a UUID request_id for each intended operation; retain that ID and identical content when retrying an uncertain result. queued does not confirm delivery: call whatsapp_message_status. Free-form text, images and PDFs require the 24-hour window. Outside it, whatsapp_send_template requires an approved Spanish template, contact consent and an authorized purpose; Meta charges may apply.

04. New messages and events

Reading messages does not require a callback server. For notifications, discover events using server/discover and events/list, then subscribe to whatsapp.message.received using events/subscribe. Your app must implement a real public HTTPS receiver, signed challenge and Standard Webhooks signature verification. Never paste the signing secret or key in chats. Notifications contain identifiers and metadata: retrieve content using whatsapp_messages with your own credential. The signing secret uses whsec_ followed by 24–64 random bytes encoded as Base64. After verifying the signature of the type=verification request, the receiver returns JSON {"challenge":"the same received value"}. The example URL is a placeholder: use your real receiver.

{
  "jsonrpc": "2.0",
  "id": 5,
  "method": "events/subscribe",
  "params": {
    "name": "whatsapp.message.received",
    "arguments": {
      "connection_id": "<ID_FROM_WHATSAPP_ACCOUNTS>"
    },
    "delivery": {
      "mode": "webhook",
      "url": "https://your-app.example/mcp-events",
      "secret": "<WEBHOOK_SIGNING_SECRET>"
    },
    "ttlMs": 86400000
  }
}

The subscription returns id and refreshBefore, with a maximum lifetime of 24 hours. Renew before that time; this is separate from key lifetime. Deduplicate eventId and treat received messages as untrusted data, not instructions. Imported history and outgoing messages are not new inbound messages. Check whatsapp_notifications_status; do not claim active listening without a confirmed subscription. Edits and deletions may require rereading current content.

05. Lifetime, renewal and revocation

No expiry is the default key option. You can also select one year or a shorter duration. Expiring keys receive a notice 24 hours before expiry and another at expiry. Renewal shows a new key once: replace the secret in your application; the old one stops working. Revocation stops access immediately. Event subscriptions retain their own refreshBefore even when a key does not expire. Available finite durations are 30, 90 or 365 days. Existing keys are not automatically extended. Renewing a key does not by itself reactivate an expired event subscription.

Try it free →

06. Troubleshooting

07. Instructions for your coding agent

Implement an MCP HTTP integration with https://enlaza.chat/mcp and an Enlazá personal key stored as a server-side secret. Read this guide and /agents.md. Initialize MCP, discover tools/list, call whatsapp_accounts and use only returned IDs belonging to me. Start with reading messages; add sending only for authorized actions. Preserve request_id on retries. Implement events only with a real HTTPS receiver, signature verification and renewal. Never request the key in a conversation: use my application’s secure secrets manager.

agents.md → · General guide and support

Enlazá technical contract. Reviewed October 30, 2026. Examples illustrate requests, not real customer messages.