Native HTTP
Use fetch without making an SDK a deployment dependency.
Use the ChatRail WhatsApp API from Node.js
Send idempotent alerts, validate external input and process signed reply events with production-oriented Node.js patterns.
Framework-neutral examples for maintained Node.js runtimes with native fetch and cryptography.Safe retries
Reuse an idempotency key when an outcome is uncertain.
Verified replies
Authenticate raw webhook bytes before parsing JSON.
Create a bounded API client
const response = await fetch(url, {
method: "POST",
signal: AbortSignal.timeout(8000),
headers: {
Authorization: `Bearer ${process.env.CHATRAIL_API_KEY}`,
"Content-Type": "application/json",
"Idempotency-Key": eventId
},
body: JSON.stringify(message)
});Set a timeout, validate inputs before serialization and distinguish retryable server failures from permanent request errors.
Keep keys and recipients server-side
Load credentials from a secret manager or protected environment and never return them to the browser. Authorize the application user before allowing them to choose a workspace connection or recipient.
Handle uncertain outcomes
A timeout does not prove the message failed. Retry with the same idempotency key and cap attempts with exponential backoff and jitter. Move repeatedly failing work to an inspectable dead-letter state.
Verify webhook bodies before JSON parsing
Configure the framework to expose the raw request bytes. Check signature length, timestamp freshness and the HMAC using constant-time comparison, then parse against a strict event schema.
Instrument the boundary
Measure request latency, status class, queue delay and webhook processing outcome using identifiers rather than customer content. Redact tokens and phone numbers from exceptions.
Frequently asked questions
Is a ChatRail Node.js SDK required?
No. These patterns use the HTTP API directly.
Should API calls run in the browser?
No. Keep API keys, recipient authorization and retries in a trusted server environment.
Which framework is supported?
Any Node.js framework that can make HTTPS requests and expose raw webhook request bytes can use the API.
CONTROL THE OUTCOME
Start with one event and one reply path.
Prove the operational loop before increasing traffic or automation.
Gain Access