Arseny Ivanchuk for WABB

Posted on Nov 11

WhatsApp QR Codes and Short Links by API: Create, Edit and Retire Them from Code

#whatsapp #api #backend #webdev

This article was checked by the WABB team against Meta's "QR Codes and Short Links" page, read on 11 November 2026.

A printed QR code outlives most campaigns. If the first message it sends is baked into the link, changing it means reprinting. WhatsApp has an API for this: it creates a QR code and a short link whose prefilled message you can edit later, and it gives you a way to retire one. This post walks through the five calls, the limits Meta sets, what the customer sees in each edge case, and what the page does not give you. Where we add our own view, we say so.

The short version

The endpoint is message_qrdls on a business phone number. You create, list, read, update and delete.
A create call returns a code, a deep_link_url (https://wa.me/message/<code>) and, if you asked for it, a QR image URL.
The prefilled message holds up to 140 characters of text and can be changed or deleted at any time.
One phone number can have at most 2,000 QR codes and short links.
There are no scan analytics. Meta says it limits what it logs to protect user privacy.
Codes do not expire on their own. You retire them with a DELETE call.

Create a code

Figure 1. One POST returns the short link and the QR image.

You post to the phone number's message_qrdls edge with two properties: prefilled_message, your text, and generate_qr_image, either SVG or PNG. This is Meta's example, with the access token shortened:

curl 'https://graph.facebook.com/v27.0/106540352242922/message_qrdls' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer EAAJB...' \
-d '
{
"prefilled_message": "Cyber Monday",
"generate_qr_image": "SVG"
}'

The response has four fields:

{
  "code": "4O4YGZEG3RIVE1",
  "prefilled_message": "Cyber Monday 1",
  "deep_link_url": "https://wa.me/message/4O4YGZEG3RIVE1",
  "qr_image_url": "https://scontent-iad3-2.xx.fbcdn.net/..."
}

Keep the code. Every later call uses it.

Source: Meta for Developers, "QR Codes and Short Links" (updated 21 May 2026), checked 11 November 2026. Related guide on WABB: WhatsApp Business QR Code & Short Link, which covers the same idea inside the Business app.

List, read, update, delete

Figure 2. The four calls after create.

List: GET on /{phone-number-id}/message_qrdls returns every code on the number, each with code, prefilled_message and deep_link_url.
Read one: the same GET with the code appended as a path parameter.
Update: a POST to the edge with code and the new prefilled_message. Meta's example changes "Cyber Monday" to "Cyber Tuesday" and the response keeps the same code and link. The printed QR keeps working; only the text it sends changes.
Delete: DELETE on /{phone-number-id}/message_qrdls/{code}. The response is {"success": true}. Meta says QR codes do not expire automatically, so a campaign that ends is a code you have to delete yourself.

Meta's page also says you can do all of this in the Business Manager UI, which is handy for a one-off.

Source: Meta for Developers, "QR Codes and Short Links", checked 11 November 2026. Related guide on WABB: How to Add a WhatsApp Chat Button to Your Website.

What the customer sees

Figure 3. Three edge cases and what happens in each.

Meta lists three cases:

The code or link was deleted: the customer sees an error saying the QR code or short link has expired.
The customer had blocked the business: they get a prompt asking whether to unblock it to keep messaging.
A short link is opened on a desktop browser: the desktop client opens with the message in the chat. If it is not installed, the customer is asked to install it.

Meta also says users go straight into the app with no interstitial page. For a printed code, the "expired" screen is the one to plan for: a poster that outlives its code sends people to an error.

How a short link differs from a plain wa.me link

A classic wa.me link carries the phone number and the message in the URL. A short link carries a random code. Meta's FAQ names two gains: the prefilled message can be edited or deleted at any time, and the URL no longer embeds the message or shows the phone number. If you already generate links, our WhatsApp link generator builds the classic form, and the chat button puts one on a site.

What the page does not give you

Scan counts. The page says analytics are not available. The code does not tell you how many people scanned it.
Styling. Meta does not offer native customisation. It says you can edit the downloaded code in other software, but recommends leaving colour and look alone to keep it readable. It recommends SVG for print, because it scales to packaging and signage.
Language routing. Meta says you are responsible for using the right code for the expected location and language of your users.

What to do in code

Meta does not prescribe this. These are our suggestions.

Store code with what it is for: which poster, which shop, which campaign, who owns it, when it should be deleted. The API only knows the text.
Make the prefilled text carry a marker for the placement, for example a short word the customer will not mind sending. Without analytics this is the one signal that reaches your webhook. A customer can edit the text before sending, so treat it as a hint, not a measurement.
Mind the 140 characters. Count them before you call, so the request fails in your code and not at Meta.
Delete on a schedule. Since codes never expire, put the end date in your own records and run the delete.
One code per audience and language. The page leaves that choice to you.
Handle the 2,000 ceiling if you generate codes per product or per shop.

Checklist

The code is created through message_qrdls and the code is stored
The QR image is saved as SVG for print
The prefilled message is 140 characters or fewer
Each code has an owner and an end date in your records
Someone knows what the "expired" screen looks like and who fixes it

FAQ

Is a short link the same as a wa.me link? It uses the same wa.me domain, but the path is a random code, and the message lives with Meta, so you can change it.

Can I change the message after printing? Yes. Update the code's prefilled_message. The printed QR stays the same.

Can I see how many people scanned it? No. Meta's page says analytics are not available.

What happens if I delete a code that is still in use? People who use it see an error saying it has expired.

Where can I read more on the WABB side? See the Business app guide to QR codes, the API prerequisites and the comparison of the Business app and the API.

We build tools for WhatsApp messaging at WABB. This post uses only Meta's public documentation. If you also run the Business app on the same number, see WhatsApp Coexistence, and for the ad side of the same entry point, Click-to-WhatsApp ads.

DEV Community