WhatsApp authorization

WhatsApp QR pairing: call /auth/qr/start to begin the device session. The QR token is delivered to your webhook as an account.auth.required event, and is also exposed synchronously via /auth/qr/check for polling.

1. 1. POST /v1/accounts with provider=whatsapp, auth_mode=qrcode. Optionally set provider_data.device_os / device_platform / proxy_config to control the device fingerprint shown on the phone.
2. 2. POST /v1/accounts/{account_id}/auth/qr/start to boot the device. Status returns awaiting_qr_scan; the actual QR string is delivered asynchronously.
3. 3. Listen for the account.auth.required event on your webhook — auth_payload.qr_code is the raw token your UI must render as a scannable QR image. Alternatively poll /auth/qr/check.
4. 4. After scanning, an account.auth.succeeded event lands on your webhook with provider_account_ref filled in, followed by an account.started event. POST /v1/accounts/{account_id}/runtime/start is a no-op once both arrive.

• provider_data.device_os — Optional device label shown during pairing. Leave unset unless you need a custom display name.
• provider_data.device_platform — Numeric device platform code (1=CHROME, 2=FIREFOX, 5=SAFARI, 14=IOS_PHONE, 16=ANDROID_PHONE, ...). Must be set together with device_os to take effect.
• provider_data.proxy_config — Optional network routing configuration for enterprise deployments.

WhatsApp phone-number pairing: save the phone number on the account at creation time, then enter the 8-character verify_code on the phone (Linked Devices → Link with phone number).

1. 1. POST /v1/accounts with provider=whatsapp, auth_mode=code, and provider_data.phone set to the E.164 number (digits only). The phone is persisted on the account and replayed automatically by later authentication actions.
2. 2. POST /v1/accounts/{account_id}/auth/start with an empty body. The saved phone is reused; the response carries the 8-character verify_code under auth_payload.
3. 3. Show verify_code to the user. The phone accepts it for ~3 minutes — after that, restart the flow.
4. 4. Once paired, account.auth.succeeded and account.started arrive on your webhook just like the QR flow.

• provider_data.phone — E.164 phone number (digits only, e.g. 15551234567). Set this under provider_data.phone when creating the account; later authentication actions reuse it automatically.