@getmesslo/messlo-node-sdk

Secure Node.js SDK for Messlo Login with WhatsApp.

Use this package in backend services (Next API routes, Express, Nest, Fastify) so your Messlo API key stays server-side.

Install

npm install @getmesslo/messlo-node-sdk

End-to-end demo project in this repository:

• examples/nextjs-whatsapp-login-demo

Quick start

import { MessloNodeSdk } from "@getmesslo/messlo-node-sdk";

const sdk = new MessloNodeSdk({
  apiKey: process.env.MESSLO_WA_LOGIN_API_KEY!
});

Core methods

• startWhatsAppLogin()
• getWhatsAppLoginStatus(sessionId)
• verifyWhatsAppToken(token)
• createWhatsAppLoginEventsUrl(sessionId, subscribeToken)
• openWhatsAppLoginEvents(sessionId, subscribeToken)
• verifyMessloWebhookSignature(...)

Next.js route handlers (App Router)

// app/api/auth/whatsapp-login/start/route.ts
import { MessloNodeSdk, nextAdapter } from "@getmesslo/messlo-node-sdk";

const sdk = new MessloNodeSdk({
  apiKey: process.env.MESSLO_WA_LOGIN_API_KEY!
});

export const POST = nextAdapter.startRoute(sdk);

// app/api/auth/whatsapp-login/status/[sessionId]/route.ts
import { MessloNodeSdk, nextAdapter } from "@getmesslo/messlo-node-sdk";

const sdk = new MessloNodeSdk({
  apiKey: process.env.MESSLO_WA_LOGIN_API_KEY!
});

export const GET = nextAdapter.statusRoute(sdk);

// app/api/auth/whatsapp-login/events/[sessionId]/route.ts
import { MessloNodeSdk, nextAdapter } from "@getmesslo/messlo-node-sdk";

const sdk = new MessloNodeSdk({
  apiKey: process.env.MESSLO_WA_LOGIN_API_KEY!
});

export const GET = nextAdapter.eventsRoute(sdk);

Express route handlers

import express from "express";
import { MessloNodeSdk, expressAdapter } from "@getmesslo/messlo-node-sdk";

const router = express.Router();
const sdk = new MessloNodeSdk({
  apiKey: process.env.MESSLO_WA_LOGIN_API_KEY!,
  baseUrl: process.env.MESSLO_API_BASE_URL
});

router.post("/api/auth/whatsapp-login/start", expressAdapter.startRoute(sdk));
router.get("/api/auth/whatsapp-login/status/:sessionId", expressAdapter.statusRoute(sdk));
router.get("/api/auth/whatsapp-login/events/:sessionId", expressAdapter.eventsRoute(sdk));

Environment

MESSLO_WA_LOGIN_API_KEY=your_api_key
MESSLO_WA_LOGIN_WEBHOOK_SECRET=your_webhook_secret

Webhook signature verification

Use this in your webhook receiver route:

import { verifyMessloWebhookSignature } from "@getmesslo/messlo-node-sdk";

const valid = verifyMessloWebhookSignature({
  webhookSecret: process.env.MESSLO_WA_LOGIN_WEBHOOK_SECRET!,
  rawBody,
  signatureHeader: req.headers["x-messlo-signature"]
});

Security notes

• Never expose MESSLO_WA_LOGIN_API_KEY to frontend.
• Always proxy through backend routes.
• Generate a fresh session if login fails or expires.

License

MIT