Get each new WhatsApp message from your customers on your own server: set up message forwarding on a connection, check Avox's signature, and test it end to end.
Turn on Message forwarding on a connection and Avox sends each new message your customers send to that WhatsApp number to your own HTTPS endpoint, as it arrives, signed so you can check it came from Avox. Use it to feed a CRM, a ticketing tool, your own bot or a data warehouse. Messages still appear in the Avox Inbox as usual.
Only incoming customer messages are forwarded - not delivery statuses, calls, messages your team sends, or template and account events. Those stay on Logs.
https:// on the standard port (443), with a
valid TLS certificate. Private and local addresses are refused, and redirects aren't followed.Build the endpoint
POST route that checks the Avox-Signature header and answers 200 straight away. Copy a ready-made one for Express, Next.js, FastAPI or Flask from Receive messages.Open the connection
Enter the Endpoint URL
https:// address and click Save URL. If you entered a Webhook URL in the setup wizard, it's already filled in.Turn forwarding on
AVOX_WEBHOOK_SECRET.Send a test event
Every control in the section is described on Message forwarding.
Each request is a POST with a message.received event:
{
"id": "evt_5f0c9a7e1b2d4c6e8f00a1b2c3d4e5f6",
"type": "message.received",
"api_version": "2026-10-01",
"created_at": "2026-10-10T10:00:02.000Z",
"connection_id": "0b1c2d3e-4f50-4a6b-8c7d-9e0f1a2b3c4d",
"data": {
"message_id": "wamid.HBgLMTU1NTEyMzQ1NjcVAgASGBQzQTdC",
"from": "+15551234567",
"contact_name": "Maya",
"timestamp": "2026-10-10T10:00:00.000Z",
"type": "text",
"text": { "body": "Hi, is my order on its way?" }
}
}
with the headers Avox-Signature, Avox-Event-Id, Avox-Event-Type: message.received and
User-Agent: Avox-Webhooks/1.0. Images, documents, locations, button taps and the other types are
listed with examples on Receive messages.
// Node.js 18+, Express - npm install express
import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";
const app = express();
const SECRET = process.env.AVOX_WEBHOOK_SECRET;
function verify(raw, header) {
let t = null;
const signatures = [];
for (const part of (header ?? "").split(",")) {
const [key, value = ""] = part.trim().split("=");
if (key === "t" && /^\d+$/.test(value)) t = Number(value);
if (key === "v1") signatures.push(value);
}
if (t === null || Math.abs(Date.now() / 1000 - t) > 300) return false; // 5 minutes
const expected = createHmac("sha256", SECRET).update(`${t}.`).update(raw).digest();
return signatures.some((sig) => {
const given = Buffer.from(sig, "hex");
return given.length === expected.length && timingSafeEqual(given, expected); // constant time
});
}
app.post("/avox/messages", express.raw({ type: "application/json" }), (req, res) => {
if (!verify(req.body, req.get("Avox-Signature"))) return res.sendStatus(401);
res.sendStatus(200);
const event = JSON.parse(req.body.toString("utf8"));
// dedupe on event.id, skip event.test, then process event.data
});
app.listen(3000);
Versions for Next.js, FastAPI and Flask are on Check the signature.
More fixes are on Troubleshooting.
No. Messages are stored and shown in Avox as always; forwarding sends a copy to your server.
No. Only messages your customers send. Statuses are on Logs; see Matching a status to a send.
Avox retries each message for about 21 hours. If 5 messages in a row still fail, forwarding pauses and your Admins get an email. Nothing is lost from your Inbox, and you can resend from the delivery log.
Yes. An Admin edits the Endpoint URL and clicks Save URL. New deliveries go to the new address.
Nothing new is sent to your endpoint, and anything still waiting to go out is marked Failed ("Forwarding was turned off"). Messages keep arriving in your Inbox. After you turn forwarding back on, an Admin can Resend any of them from the delivery log.
A Manager can see the section, its state and the delivery log. Turning forwarding on or off, changing the URL, rotating the secret, sending a test event and resending need the Admin role.
Last updated