Z-API

Z-API is a third-party WhatsApp gateway: it runs a WhatsApp Web session for a number you link yourself. It is not Meta's official WhatsApp Business API, and WhatsApp may restrict or ban numbers that send in bulk.

Getting credentials

1. In the Z-API panel, open Instances, create or pick an instance and click edit. Copy the instance ID into ZAPI_INSTANCE_ID and the instance token into ZAPI_INSTANCE_TOKEN.
2. Open the Security tab, module Account Security Token, click Set Up Now and copy the token into ZAPI_CLIENT_TOKEN. Then click Activate Token so every request must carry it.
3. Link the phone first: scan the instance QR code in the panel with WhatsApp (Linked devices). Until then every send fails.

Workflow: call z_api_get_status first. connected: false means the QR code must be scanned again; smartphoneConnected: false means the phone is offline. Use z_api_list_chats or z_api_check_phone_exists to find the right recipient before sending.

Formats: phone numbers are digits only, country code + area code + number, no +, spaces or dashes: 5511999999999. Group chats use their ID from z_api_list_chats, e.g. 120363019502650977-group. Text supports *bold*, _italic_ and ~strike~. Images and documents are sent by public HTTPS URL; Z-API downloads them (files up to 100 MB).

Sending: the send tools write real WhatsApp messages. Always confirm the recipient and the exact text with the user before calling them, and never retry a send that returned a messageId. Messages go through a queue; z_api_list_queue shows what is still waiting.

Pagination and limits: chats and contacts take page and pageSize (both required by Z-API; the tools default to page 1). Ask for the next page until fewer results than pageSize come back. The queue uses the pagingState cursor until hasMore is false. Z-API sets no message cap, but WhatsApp watches the number: keep volumes modest and space sends minutes apart. Plans are billed per instance, with a 2-day free trial.

Cloud reachability: api.z-api.io is a public HTTPS API, reachable from AnythingMCP Cloud. If you enabled IP restriction in the Z-API Security tab, allow the AnythingMCP outbound address or turn the restriction off.