Unofficial WhatsApp APIs compared: Baileys, WAHA, Evolution

Baileys and whatsmeow are libraries, whatsapp-web.js drives a browser, WAHA and Evolution API wrap them in a REST server, and Whapi.Cloud and Green-API host the same idea. They differ in language, license and polish, but all of them log into a WhatsApp account you own and drive it from code. The number, the phone and the ban are yours.

Which one should you pick?

• Go, or a minimal footprint: whatsmeow for Go, Baileys for TypeScript. Both talk to WhatsApp over a WebSocket and need no browser.
• A working REST API this week: WAHA. It runs in Docker with Swagger, a dashboard and webhooks, and it publishes a release every two to three weeks.
• Chatwoot, Typebot or Dify in the stack: Evolution API, which ships those integrations and can also use Meta’s official Cloud API.
• The real web client, accepting Chromium: whatsapp-web.js.
• No servers to run: Whapi.Cloud or Green-API, which still link your own number.
• A number you do not own the risk of: a managed number such as whasp, or the official platform for business-specific bots.

How do they compare?

All of them document groups, media, reactions and polls. whatsapp-web.js also lists channels, and it needs Google Chrome rather than Chromium to send video.

What is different about each one?

Baileys has 11.4k GitHub stars. Its README describes a WebSockets-based library that needs no Selenium or browser. Version 7 took a long time: rc9 came out on 21 November 2025, rc10 on 6 May 2026, and rc14 on 29 July 2026 is the latest. The maintainers’ rc11 notes say its libsignal dependency is GPLv3 while Baileys is MIT, and that they plan to replace it. Read that before you ship it commercially.

whatsapp-web.js runs WhatsApp Web inside a managed Chromium through Puppeteer. That means more memory, but it uses the real web client. It needs Node 18 or later, and its latest release is 1.34.7 (24 April 2026) with commits continuing into late September.

whatsmeow is the Go library under WAHA’s GOWS engine. It is the only library in this list with passkey support merged.

WAHA is a server rather than a library. WEBJS, the default, and WPP run a browser. NOWEB (Node.js, based on Baileys) and GOWS (Go) use a WebSocket. Since release 2026.6.1, features that used to be Plus-only are in the free Core image. WAHA also documents the reachout timelock and ships an MCP app.

Evolution API adds Typebot, Chatwoot, Dify, OpenAI, RabbitMQ and Kafka hooks, plus a Cloud API mode. Its license is Apache-2.0 with extra conditions about showing its branding and notifying users, so read the file. Its last stable release is 2.3.7 (5 December 2025) and its main branch pins Baileys 7.0.0-rc.9, while the develop branch uses rc13.

Whapi.Cloud and Green-API sell the same linked-account model as a service. Whapi’s free sandbox allows 5 active conversations a month, and Green-API’s free plan allows 3 chats.

Which ones warn you before a restriction bites?

Not all of them expose WhatsApp’s restriction state. Baileys has had fetchAccountReachoutTimelock() and a reachoutTimeLock update since rc10. WAHA offers a timelock endpoint for GOWS, NOWEB and WEBJS since release 2026.8.1. whatsmeow merged its trusted-contact token handling on 27 April 2026, while a pull request to check the timelock and message caps has been open since 25 March. We did not find an equivalent in whatsapp-web.js, and Evolution API gets these features only through the Baileys version it pins. Details are in the 463 explainer.

What did the June 2026 passkey change break?

On 30 June 2026 the trackers of Baileys, WAHA, Evolution API, whatsapp-web.js and whatsmeow all received the same report. After the QR code or pairing code was accepted, WhatsApp asked for a passkey and the link never finished. It hit some accounts, not all. WAHA says “some accounts”, and Green-API says WhatsApp began an experimental move of some users in summer 2026. We found no announcement from WhatsApp.

A community analysis in Baileys issue 2672, built from a whatsmeow capture and WhatsApp Web’s code, says the server pushes a WebAuthn request after pairing, internally codenamed “Shortcake”, with user verification required. Its author marks what was observed and what was inferred. The consequence is that a headless client cannot sign it alone, so a person with an authenticator has to take part.

Where each stands:

• whatsmeow: merged passkey support on 1 July 2026.
• WAHA: the GOWS engine got it in release 2026.7.1 (15 July). A browser extension signs the challenge. NOWEB, WEBJS and WPP were still unchecked in WAHA’s tracking issue.
• Baileys: nothing is merged. A pull request adding the handshake was closed unmerged on 20 August, a second on 4 September, and the issue is open. The latest commit on master is dated 4 August.
• Evolution API: a pull request has been open since 7 July.
• whatsapp-web.js: the issue was closed by the stale bot on 19 August without a fix.

Since mid-July some users say their accounts stopped being asked. That is anecdotal, and only WhatsApp knows whether it was rolled back. Workarounds copy a session from a real WhatsApp Web tab into the library. That moves key material out of a browser profile, so treat it as sensitive.

What problem do they all share?

Every option except the official platform links an account you own as an unofficial client. WhatsApp’s help page on linked devices says linking an account to an unofficial app or website, now or in the past, may result in a temporary or permanent ban. It also says linked devices log out if the phone goes unused for more than 14 days. WAHA and Baileys carry similar warnings in their own disclaimers. See why WhatsApp bans numbers and the 463 error.

So you carry the ban, and you run the session, the phone and the warm-up. Hosted services remove the servers, not the risk.

Where does whasp differ?

whasp runs the number: a real personal WhatsApp account on its own cloud phone and its own ISP IP, warmed up, with health monitoring. You get a webhook and one API call. If a number is banned, it is replaced at no cost with the same profile, but chats do not move. It costs $49 per number every 30 days, for about 100 active users.

The trade-offs are real. Users must write first, there are no groups, no outbound voice notes and no bring-your-own number. A library gives you groups and more features, with the risk on your own account. For business-specific bots such as support or orders, the official platform is often the right answer. Meta’s terms bar general-purpose AI assistants from it, as covered in the January 2026 ban explainer.

Where to go next

For every route, official and unofficial, read how to put an AI agent on WhatsApp. To connect Claude or ChatGPT, see WhatsApp MCP servers. Details and prices are on the pricing page.