The latest articles on DEV Community by waqas ahmed waseer (@waqasahmedwaseer). https://dev.to/waqasahmedwaseer https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3966551%2F94fe79af-751f-4bde-aa4f-de2f2230a80d.jpg https://dev.to/waqasahmedwaseer en waqas ahmed waseer Wed, 03 Jun 2026 12:35:07 +0000 https://dev.to/waqasahmedwaseer/i-open-sourced-my-self-hosted-whatsapp-api-platform-after-months-of-building-4k18 https://dev.to/waqasahmedwaseer/i-open-sourced-my-self-hosted-whatsapp-api-platform-after-months-of-building-4k18 <p>After months of building and dogfooding on production, I open-sourced <strong>WaSphere</strong> today — a self-hosted WhatsApp API platform.</p> <h2> What it is </h2> <p>A Twilio alternative for WhatsApp that runs on your own server. MIT licensed, one docker-compose command to deploy.</p> <p> <iframe src="https://www.youtube.com/embed/k6tBGIApd8I"> </iframe> </p> <h2> Why I built it </h2> <p>Twilio's WhatsApp pricing breaks small businesses. The few self-hosted options out there are either abandoned, missing security basics (most have no SSRF guard on webhook delivery), or have brutal developer experience.</p> <p>WHMCS resellers and dev teams deserve better.</p> <h2> What's in v1.0 </h2> <ul> <li>One docker-compose command deploys the full stack</li> <li>Multi-session — connect unlimited WhatsApp accounts per instance</li> <li>14 message types via REST API</li> <li>HMAC-signed webhooks (HMAC-SHA256 over timestamp.body)</li> <li>SSRF guard with DNS pinning + private-IP denylist</li> <li>Scoped API keys with 12 granular permissions + per-session scoping</li> <li>Developer dashboard with audit log and dark mode</li> <li>MIT licensed</li> </ul> <h2> Security decisions </h2> <p>The security pass before opening it up was non-negotiable:</p> <ul> <li>SSRF guard with DNS pinning + manual redirect (blocks cloud metadata)</li> <li>AES-256-GCM for stored secrets</li> <li>Argon2id passwords + timing-safe login</li> <li>JWT refresh-token rotation with reuse detection</li> <li>Registration locks after first admin</li> </ul> <h2> Architecture </h2> <p>Two cleanly separated services so the GPL-licensed Baileys engine stays isolated from the application layer:</p> <ul> <li> <strong>WA Server</strong> — WhatsApp gateway (the GPL boundary)</li> <li> <strong>Dashboard API</strong> — auth, workspaces, webhooks, proxy</li> <li> <strong>Dashboard UI</strong> — Next.js console</li> </ul> <p>The GPL/MIT licensing boundary is real and important. Baileys only runs in the WA Server binary. The dashboard, API, and auxiliary code stay MIT-clean.</p> <h2> Try it </h2> <ul> <li> <strong>Live demo (no signup)</strong>: <a href="https://demo.wasphere.com" rel="noopener noreferrer">demo.wasphere.com</a> </li> <li> <strong>GitHub</strong>: <a href="https://github.com/wasphere/wasphere" rel="noopener noreferrer">github.com/wasphere/wasphere</a> </li> <li> <strong>Website</strong>: <a href="https://wasphere.com" rel="noopener noreferrer">wasphere.com</a> </li> <li> <strong>3-min walkthrough</strong>: <a href="https://youtu.be/k6tBGIApd8I" rel="noopener noreferrer">youtu.be/k6tBGIApd8I</a> </li> </ul> <p>Honest feedback welcome — especially the harsh kind.</p> <p>What would you want to see in v1.1?</p> opensource whatsapp selfhosted node