Connect WhatsApp to Hono

Summary

Trust starts at the signed webhook. We create the minimal Hono app, register whatsapp.message.received in Kapso, and prove a real phone message reaches the app and gets a reply.

Steps

1. Create the minimal module-level Hono application.
2. Verify the raw body with X-Webhook-Signature before parsing it.
3. Parse unbuffered and buffered Kapso v2 payloads.
4. Ignore non-text, outbound, business-app, history-sync, and wrong-number events.
5. Derive the customer phone from the signed event and send a fixed reply.

// Verify first, parse second. Never trust identity from the body alone.
const ok = verifyWebhook(rawBody, signature, WEBHOOK_SECRET);
if (!ok) return c.json({ error: "bad signature" }, 401);

Proof

Send a real WhatsApp message from your phone and watch it arrive in the app logs with a reply.

Principle

The transport is trusted, but each request still arrives without memory. Next: durable conversation state.