# Purchase requests on WhatsApp

> Message Atta on WhatsApp to request a purchase, and approve or decline with reply buttons. Your number links once to your account and follows the same rules.

Updated 2026-11-06. Source: https://atta.sh/integrations/whatsapp

Atta runs on a WhatsApp business number. Message it to ask for something, and it answers with the same agent as the web chat, as you. Approvals arrive as reply buttons. Your phone number links once to your Atta account, and every message is checked against that link and the workspace's approval rules.

## What a conversation looks like

WhatsApp has no channels, threads or slash commands. A conversation is you and the business number. The agent can search, compare, fill a cart, check out, show orders and requests, and check stock.

> **Amir:** 10 boxes of nitrile gloves, medium, for the clinic
>
> **Atta:** Found them at $11.40 a box from your medical supplier. Ten is $114.00, arriving Tuesday. That's within your limit. Order now?
>
> **Amir:** yes
>
> **Atta:** Ordered. $114.00 reserved against the clinic budget.

If the amount is over what you can approve alone, the request goes to the next approver in the chain. Approvers are notified in the inbox and by email. Typing `requests` on WhatsApp lists what's waiting on you, one message per request with Approve and Decline reply buttons.

## Commands

`connect`, `link smcp_...`, `unlink`, `requests` (or `approvals`) and `help`. Anything else is a message to the agent. Commands never reach the model.

## How approvals work

A checkout that needs your confirmation pauses the agent. The prompt shows the policy's reason and Approve and Cancel as reply buttons, in your language. A tap resumes the run only from the linked member whose conversation it is.

A request for someone else follows the web path. The buttons call the same function the requests page does, as the linked member, so the approval chain advances one step per answer. WhatsApp has no approval rules of its own.

## Who the number acts as

The first time an unlinked number writes, it gets a Connect account button. It opens a page that shows the profile name and the last four digits of the number. WhatsApp gives Atta no email to compare, so the page warns plainly that whoever holds that number can shop and approve as you, and links only when you press the button. The link expires after 15 minutes.

The link is a minted MCP token. Every message is checked against it, so a revoked token or a member who left is refused on the next message. Each link emails the member a one-click revoke. To unlink, send `unlink` or press Disconnect in Settings.

You can also send `link smcp_...` with a token from Settings. A message carrying a token never reaches the model.

A turn passes the hourly ceiling and the workspace's model budget before any model work runs.

## Setting it up

The first four steps need an operator. Members do the last.

1. **Deploy Atta** at a public https URL. Locally, use a tunnel.
2. **Create a Meta app** with the WhatsApp product, and a System User token with the `whatsapp_business_messaging` permission.
3. **Set** `WHATSAPP_ACCESS_TOKEN`, `WHATSAPP_APP_SECRET`, `WHATSAPP_PHONE_NUMBER_ID` and `WHATSAPP_VERIFY_TOKEN` (any string you choose), then redeploy.
4. **Add the webhook** in Meta with the callback URL `https://<host>/eve/v1/whatsapp`, that verify token, and a subscription to `messages`.
5. **Each member writes to the number once** and presses Connect account.

A workspace can also connect its own number in Settings, if someone with workspace management enters the phone number id, access token, app secret and verify token. Its webhooks verify with that number's app secret and it acts only in that workspace.

For development, `WHATSAPP_MOCK=1` runs the real adapter against a table instead of Meta, with a mock phone at `/whatsapp/mock`. The production build ignores it.

## Questions

### Do approvers have to open the app?

No. Send requests on WhatsApp and each pending request comes back as a message with Approve and Decline buttons. A tap answers it as the linked member.

### Is a WhatsApp number as safe as a login?

The link asks you to press a button on a signed-in page, and warns that whoever holds the number can shop as you. The link can be revoked from an email or Settings, and each message is checked against it.

### Does the agent bypass approval over WhatsApp?

No. Every call goes through the same policy as the web. A purchase over your limit becomes a request for the next approver, wherever you asked for it.

### Can I use my own WhatsApp number?

Yes. Someone with workspace management can connect the workspace's own business number in Settings, using its phone number id, access token and app secret.