Limits and the abuse guard

Rate limits, sizes and how wrong keys are handled.

What	Limit
Requests per key	20 a second, bursts of up to 40
Failed sign-ins from one address	50 in 5 minutes blocks that address for 15 minutes
Text message	4096 characters
File caption	1024 characters
Your reference	512 characters
One-time code	15 characters, no spaces
Image file	5 MB
Video file	16 MB
Audio file	16 MB
Document file	100 MB
Webhooks	5
People in one campaign (a list of numbers)	1,00,000
Items on a page	50 (at most 100)
Idempotency-Key	255 characters, remembered 24 hours
Received file link	works for 15 minutes

Rate limit

Every answer has X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Over the limit you get rate_limited with Retry-After (seconds).

Daily messaging limit

Your WhatsApp number can message a set number of people a day (not messages). GET /v1/usage shows how many you have messaged (people_messaged_24h), your daily_limit and what is remaining. Over it: daily_limit_reached.

The abuse guard

If one address sends too many wrong or missing keys in a short time, every request from that address answers unauthorized for a while, even with a good key. Check your key, then wait.