Zagel (زاجل) is a lightweight, single-container WhatsApp REST API gateway that allows web apps, microservices, and backend servers (Python, Node.js, Go, PHP) to send automated messages and verify OTPs through WhatsApp without multi-container complexity or vendor lock-in.

Zagel receives standard HTTP REST calls authenticated with an API key, validates the payload and rate limits, and uses an embedded Baileys engine over WebSockets to deliver the messages directly through the WhatsApp multi-device network.

Can I fork Zagel to build my own WhatsApp gateway?

Yes. Zagel is fully open-source under the MIT license. You can fork the repository and launch your own branded, private WhatsApp gateway on any Virtual Private Server (VPS), Docker host, or Cloud Container Platform in under 60 seconds.

Does Zagel require an external database like Redis or PostgreSQL?

No. Zagel is zero-dependency by default and persists session state reliably to disk with atomic writes. Optional MongoDB support is available for distributed cloud environments.

Zagel - Lightweight WhatsApp REST API Gateway & Developer Cockpit

What is Zagel?

Named after the legendary carrier pigeon (حمام زاجل) that pioneered rapid, reliable point-to-point communication, Zagel is an open-source WhatsApp REST API gateway built specifically for developers who need to dispatch messages without infrastructure headache.

Most WhatsApp solutions force you into complex multi-container Docker Compose stacks mandating PostgreSQL, Redis, and external message queues just to send a notification. Zagel eliminates that complexity: it runs as a single process inside a single lightweight container, saving costs and making deployment effortless.

Zero External Databases Required: Persists session state reliably to local disk with atomic writes.
Self-Contained Cockpit: Integrated QR-code and 8-digit pairing hub, token studio, and real-time live audit logs.
Developer First: Generates copy-paste code in cURL, Python, Node.js, and Go with one-click token authorization.

Architecture Comparison

Capability	Zagel Gateway	Heavy Alternatives
Container Footprint	1 Single Container	4+ Microservices
Database Requirement	Zero (Local Atomic JSON)	Postgres + Redis
Memory Footprint	~120 MB RAM	1.5 GB - 3 GB RAM
Deployment Flexibility	Any VPS, Docker, or Cloud PaaS	Requires Multi-Node VPS
Built-in Token Manager	Native SHA-256 Studio	External Auth Service
Integrated Developer UI	Included at /dashboard	Separate Frontend App

How Zagel Works

An end-to-end look at how standard HTTP REST calls flow securely through the gateway to WhatsApp recipients.

Stage 1

Your Backend Service

Your web app, microservice, or CRM dispatches standard HTTP POST requests with an API key.

cURL / Python / Node / Go

Stage 2

Zagel REST Engine

Express 5.x applies timing-safe SHA-256 authentication, validates phone numbers, and enforces anti-spam rate limits.

Timing-Safe Auth Gate

Stage 3

Embedded Baileys Engine

Translates JSON payloads into binary WebSocket protocol packets connected to WhatsApp multi-device.

Direct WebSocket Link

Stage 4

WhatsApp Recipient

The message or OTP arrives on the recipient's phone instantly, triggering webhook callbacks.

Sub-Second Delivery

Engineered for Reliability

Everything needed to run automated WhatsApp messaging in production with confidence.

Text & Media Dispatch

Send plain text, images, PDF documents, and audio attachments with custom captions and automatic MIME detection.

Cryptographic OTP Engine

Built-in 6-digit one-time passcodes with in-memory expiration tracking, phone-level rate limits, and constant-time validation.

Zero-Trust Admin Security

Dual-tier authorization: Master Admin Key protects pairing sessions and tokens, while granular Client Tokens handle dispatches.

API Token Governance

Create labeled client tokens (wa_live_...), monitor token creation dates, and revoke compromised keys instantly.

Automatic Socket Watchdog

Continuous background health checks detect dropped connections and automatically re-establish the WhatsApp socket seamlessly.

Outbound Webhook Dispatch

Forward delivery receipts and incoming customer WhatsApp messages straight to your application's webhook listener.

Interactive API Reference

Send messages in seconds. Switch between languages and endpoints to view ready-to-run examples.

// Loading API snippet...

Fork & Deploy Your Own Gateway

Host your own private WhatsApp gateway on your infrastructure with a single click or command.

Deploy on Virtual Private Server (VPS / Linux Host)

Host on any Linux VPS or virtual machine with persistent local disk storage and automatic process management.

# 1. Clone your forked repository onto your VPS
git clone https://github.com/YOUR_USERNAME/zagel.git
cd zagel && npm install

# 2. Configure environment
cp .env.example .env
# Edit .env with your secure ADMIN_API_KEY and PORT

# 3. Start with process manager (PM2) for 24/7 background persistence
npm install -g pm2
pm2 start src/server.js --name zagel
pm2 startup && pm2 save

Fork on GitHub

Frequently Asked Questions

Answers to common questions about running, pairing, and self-hosting Zagel.

What makes Zagel different from other WhatsApp API gateways?

Zagel is designed with zero external database dependencies. While other platforms mandate complex setups with PostgreSQL, Redis, and multi-service Docker Compose networks, Zagel runs entirely within a single Node.js or Docker process. It stores sessions reliably using atomic writes on disk, features an integrated Developer Cockpit, and can be deployed in minutes to any VPS, Docker host, or cloud container platform.

How do I pair my WhatsApp account with Zagel?

Open the Developer Cockpit at /dashboard and unlock it using your Master Admin Key. Zagel will display either a high-contrast QR code or let you generate an 8-digit phone pairing code. Open WhatsApp on your mobile phone, go to Linked Devices > Link a Device, and scan the QR code or enter the pairing code. Your session is saved automatically and stays active indefinitely.

How does authentication and security work?

Zagel uses a dual-tier zero-trust security architecture. The Master Admin Key (ADMIN_API_KEY) is required to view pairing codes, access the full cockpit, generate tokens, and clear audit feeds. For everyday application calls (sending messages, verifying OTPs), you generate scoped Client Tokens (wa_live_...) validated using timing-safe SHA-256 string comparisons to prevent timing attacks.

Can I fork this repository and brand it for my own business?

Absolutely! Zagel is licensed under the permissive MIT license. You can fork it, customize the branding or UI in src/public/, and host it as your company's private gateway microservice. The public landing page at / serves as an introduction and API reference, while your internal team accesses /dashboard.

How can I make the root URL go directly to the dashboard instead of the landing page?

If you prefer having the Developer Cockpit served at / for a private internal deployment, simply set the environment variable DEFAULT_ROOT=dashboard in your .env file or cloud container environment settings.

Production-Grade WhatsApp REST API Gateway