Unofficial WhatsApp APIs and QR-code logins: the documented ban risk

An unofficial WhatsApp API is not an interface Meta operates. It is a program that logs into WhatsApp as though it were your laptop, by scanning the linked-device QR code on the phone holding the account, then sends and reads messages through that session. Meta’s terms prohibit that in several separate clauses, and the account carrying the consequence is your number, not the vendor’s server. This is a reading of published terms and not legal advice.

The mechanism is a logged-in session, not an interface

The Cloud API is something Meta hosts and you call. An unofficial client speaks the protocol the WhatsApp Web session speaks, on credentials taken from a QR code scanned on a real phone. WhatsApp’s Terms of Service, carrying “Effective Date: January 4, 2021” when we read them on 19 September 2026, grant “a limited, revocable, non-exclusive, non-sublicensable, and non-transferable license to use our Services”, and under Harm To WhatsApp Or Our Users you must not

distribute or make our Services available over a network where they could be used by multiple devices at the same time, except as authorized through tools we have expressly provided via our Services

WhatsApp Web and the linked-device flow are tools Meta expressly provided. A program borrowing that session is not one of them, and the exception is a closed list rather than a standard.

The clauses, in Meta’s words

The umbrella sentence comes first: “You must access and use our Services only for legal, authorized, and acceptable purposes.” Meta’s wording is on the left, our reading on the right.

Terms of Service, prohibited	What it covers
“gain or attempt to gain unauthorized access to our Services or systems”	Any route Meta did not authorise for you.
“create software or APIs that function substantially the same as our Services and offer them for use by third parties in an unauthorized manner”	The vendor’s side of it, not only yours.
“collect information of or about our users in any impermissible or unauthorized manner”	Scraping profiles, numbers, group membership.
“involve sending illegal or impermissible communications such as bulk messaging, auto-messaging, auto-dialing, and the like”	Automation and bulk sending, by name.
“involve any non-personal use of our Services unless otherwise authorized by us”	Running a business on a consumer account.

The bulk and automation bar sits in the consumer terms, so it binds a personal number long before any business agreement does.

The business agreements say it more plainly

The WhatsApp Business Terms of Service open their Restrictions section with “Except as otherwise permitted by WhatsApp in writing”, then bar two things that describe an unofficial client exactly: “scrape or extract data from our Business Services” and

develop or use any applications that interact with our Business Services without our prior written consent

Prior written consent is the whole test, and a tool Meta has not authorised fails it by definition. The same document has you warrant, on signing up, that you “have not been previously suspended or removed from our Business Services, or engaged in any activity that could result in suspension or removal”. Read it before planning a move to official tooling after a ban.

What Meta actually publishes as the consequence

Every published statement is about Meta’s rights, not about your odds. On a consumer account, the Terms of Service say that if you violate them “we may take action with respect to your account, including disabling or suspending your account and, if we do, you agree not to create another account without our permission”, and separately that

We may modify, suspend, or terminate your access to or use of our Services anytime for any reason, such as if you violate the letter or spirit of our Terms or create harm, risk, or possible legal exposure for us, our users, or others.

On a business account the Business Terms of Service grant a graduated right: “we have the right to limit, throttle, suspend, or terminate Company’s account, depending on the type and circumstances of the breach and within our reasonable discretion”. Termination is not the end of it: “In the event that we terminate Company’s account, Company will not create another WhatsApp business account without our express written permission.”

The Business Messaging Policy names this use case rather than implying it:

If you use or operate a service which utilizes WhatsApp in violation of our terms or policies, such as messaging people at scale in an unauthorized manner, we have the right to limit or remove your access to WhatsApp Business Services.

The same section reserves the harshest outcome for termination, where Meta “may prohibit you and your organization from all future use of WhatsApp products and services”. The Business Solution Terms, which govern API access, say the same: “We may terminate your account and revoke your access if we reasonably determine that you have breached these restrictions.”

The graduated ladder is a Platform feature you will not get

Meta’s enforcement documentation, updated 21 May 2026, publishes an escalation path: a warning, then message blocks measured in days, then “An account lock, which is an indefinite block on sending any messages; can only be removed via an appeal”, then permanent removal from the platform.

Read its scope first. The page covers what happens when “WhatsApp will enforce on WhatsApp Business Accounts that repeatedly violate the WhatsApp Business Messaging Policy”. A number driven by an unofficial client has no WhatsApp Business Account, so no violation record in Business Support Home, no policy webhook and no appeal queue of its own. That transparency is attached to the platform you declined to use.

What Meta does not publish

No probability, no message-per-day threshold, no warm-up schedule, no count of accounts actioned this way, no notice period on a consumer account.

That absence is where the folklore lives. Sending caps said to keep a QR session safe, warming a number up over a fortnight, a fresh SIM resetting your risk, a vendor promising to reverse a ban: none of it appears on any page cited here. We have not tested those claims and we are not going to assert them on someone else’s account of their own client base. WhatsApp’s Help Centre holds further material on bans, but those pages render their body by script, so we could not snapshot them and have quoted nothing from them.

One thing is documented. Disputes over “efforts to interfere with our Services or engage with our Services in unauthorized ways (for example, automated ways)” are carved out of the consumer terms’ ordinary dispute process as Excluded Disputes.

The rule does not expire on 23 September 2026

The Business Terms of Service we quote carry a banner: “We’re updating the WhatsApp for Business terms, effective September 23, 2026.” We read the preview of the replacement, headed “Effective September 23, 2026”, and the restriction survives with one word changed, as “develop or use any applications that interact with our Business App Services without our prior written consent”. The multiple-device clause survives too, still limited to “tools and configurations that we have expressly provided for your use”.

Why this is our own rule as well

Official channels only is the second of three constraints this product is specified under, and one check in tests/claim_register.test.ts holds this part of it: it reads package.json and fails if any of eight named WhatsApp Web automation packages appears there. Specified rather than built: no channel is connected to mesej today, so nothing here has answered a customer, and the check is a rule about what may be added rather than a report on a running system. That is narrow on purpose, and it is a named-package check rather than a guarantee about everything in the tree. We do not print the package names here, because the point is the contract rather than the code.

The useful question for a vendor is not whether bans happen. It is which account you are asked to connect, because a QR code puts the risk on your number and leaves any appeal to you. Judging a tool by its platform’s terms rather than its landing page is the same exercise as reading Google’s published reply rejection reasons before buying a review management tool.