DevraByte Gateway

WhatsApp providers (Meta, Termii) expect a webhook response almost immediately, or they retry — which can duplicate messages. Every inbound webhook is acknowledged first, then the actual work (running the AI agent, writing to the database, sending the reply) happens afterward using Vercel's deferred execution (after()), so the response is never held up waiting on Claude or Postgres.

Every inbound webhook is checked before anything runs — HMAC-SHA256 for Meta'sX-Hub-Signature-256, and a shared secret token for Termii. Requests that don't verify are acknowledged and dropped, not processed.

The same gateway speaks Meta Cloud API and Termii, so a business isn't locked to one WhatsApp provider — useful when official Meta Business verification is slow and a faster self-serve number is needed to get started.

Inbound traffic is rate-limited per sender, and message processing checks the organization's plan before running the AI agent — so a spike in traffic can't run up unbounded inference cost.