waba-embedded-signup
Guides WhatsApp Business Account onboarding through Sent, separating dashboard Embedded Signup, organization WABA inheritance, and direct child-profile credentials. Use for WABA connection, Meta signup, profile creation, access-token handling, phone number mapping, completion callbacks, or WhatsApp onboarding failures.
- Installs
- 2.9K
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/sentdm/sent-plugin --skill waba-embedded-signup- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads waba-embedded-signup automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
WABA Onboarding and Embedded Signup
Keep three integration paths distinct. Calling all of them “Embedded Signup” creates wrong API designs and unsafe credential handling.
The three paths
| Path | Where it starts | Profile behavior |
|---|---|---|
| Organization Embedded Signup | Sent dashboard | Connects the organization's WABA through the hosted Meta flow. There is no public Sent endpoint that starts this flow. |
| Organization WABA inheritance | POST /v3/profiles | Omit whatsapp_business_account; the child inherits the organization's connected WABA. |
| Dedicated child-profile WABA | POST /v3/profiles | Supply whatsapp_business_account.waba_id and .access_token; phone_number_id is optional. |
If credentials are omitted and the organization has no connected WABA, profile creation returns 422. Direct WABA credentials are a profile-creation feature, not a public “Embedded Signup endpoint.”
Authentication
Use either:
- a profile-specific key in
x-api-key; or - an organization key in
x-api-keyplusx-profile-idwhen operating for an existing child profile.
Only organization keys may use x-profile-id; profile keys receive 403. x-sender-id is legacy v1/v2 terminology.
Path A: organization Embedded Signup
- An authorized organization administrator opens the Sent dashboard WhatsApp connection flow.
- The hosted Meta Embedded Signup UI collects the Meta authorization and WABA/number choices.
- Confirm the organization shows a connected WABA before creating inheriting children.
- Record non-secret identifiers and audit who completed the action.
Do not invent a POST /embedded-signup or token-exchange endpoint in Sent's public API. If building your own Meta Tech Provider integration outside the Sent dashboard, follow Meta's current documentation and keep that system separate from the Sent API contract.
Meta's browser postMessage events use an event field and nested data/session information. Do not rewrite them as Sent webhook sub_type envelopes.
Path B: inherit the organization WABA
Omit whatsapp_business_account:
{
"name": "Tenant Support",
"description": "Synthetic child profile",
"short_name": "SUPPORT",
"inherit_templates": true,
"billing_model": "organization",
"sandbox": true
}
Use this only after the organization WABA is connected. Inheritance means the tenant shares that WABA boundary; confirm this matches the tenant/brand architecture.
Path C: dedicated WABA credentials
{
"name": "Dedicated Tenant",
"whatsapp_business_account": {
"waba_id": "123456789012345",
"phone_number_id": "987654321098765",
"access_token": "<injected secret>"
},
"sandbox": true
}
waba_id and access_token are required. phone_number_id is optional: when omitted, the current contract describes provisioning and registration during onboarding.
The token needs the applicable WhatsApp Business messaging and management permissions. Inject it from a secret manager. Never log it, echo it, write it to fixtures, return it to the browser, include it in support output, or retain it in general profile storage. Sent does not return it in API responses.
Complete the profile
Call POST /v3/profiles/{profileId}/complete with the required webHookUrl:
{
"webHookUrl": "https://example.com/webhooks/profile-complete",
"sandbox": true
}
202means background processing started; there is no final status in that response.200can mean the profile was already complete and currently demonstrates lowercasecompleted.- The completion callback can report
COMPLETED,SUBMITTED, orfailed.
Treat the completion callback as its own integration surface. Its envelope uses event, not sub_type:
{
"event": "COMPLETED",
"profile_id": "00000000-0000-0000-0000-000000000000",
"timestamp": "2026-08-09T12:00:00Z"
}
Preserve unknown event strings. Verify authenticity using the mechanism Sent documents for the callback endpoint and make processing idempotent.
Verify operational readiness
- Profile WABA ID matches the intended business.
- Selected number is mapped to the intended profile.
- Template sharing/inheritance is intentional.
- A test template can be created with
sandbox: true. - The completion callback is reachable and idempotent.
- Returned message IDs are stored against the tenant/profile before webhook processing.
- Tokens and payment values are absent from logs.
For ordinary message and template webhooks, follow Sent's current events reference; those are separate from Meta browser events and profile-completion callbacks.
Failure routing
| Failure | Next action |
|---|---|
422 when credentials are omitted | Connect the organization WABA or provide dedicated credentials. |
403 with profile key and x-profile-id | Remove x-profile-id or use an authorized organization key. |
| Wrong WABA/number | Stop before completion and correct the profile mapping. |
| Expired/under-scoped token | Replace it securely; never print it while diagnosing. |
| Completion remains submitted | Inspect prerequisite and callback evidence; do not assume final failure from the 202. |
Use references/waba-embedded-signup-spec.md, references/waba-onboarding-runbook.md, and references/whatsapp-sender-profile-mapping.md. Use sender-profile-architect for tenant boundaries and waba-template-author for the first template.
FAQ
What does the waba-embedded-signup skill do?
Guides WhatsApp Business Account onboarding through Sent, separating dashboard Embedded Signup, organization WABA inheritance, and direct child-profile credentials. Use for WABA connection, Meta signup, profile creation, access-token handling, phone number mapping, completion callbacks, or WhatsApp onboarding failures.
How do I install waba-embedded-signup?
Run npx skills add https://github.com/sentdm/sent-plugin --skill waba-embedded-signup in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/waba-embedded-signup/ (personal) or .claude/skills/waba-embedded-signup/ (project).
Which AI agents can use waba-embedded-signup?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is waba-embedded-signup safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains waba-embedded-signup?
It is published by sentdm in sentdm/sent-plugin. It has 2,905 recorded installs.
More from sentdm/sent-plugin
sent
sentdm/sent-plugin
Routes broad or ambiguous Sent requests to the correct MCP-backed operation or specialist skill. Use when the user asks what Sent can do, says "help me with Sent" or "set up messaging," needs several Sent workflows, or has not made the channel, task, or desired operation clear enough to select a more specific skill.
waba-template-author
sentdm/sent-plugin
Writes, classifies, validates, and repairs WhatsApp templates using the Sent v3 template definition contract. Use for utility, marketing, authentication, OTP, Meta review, rejected templates, variables, buttons, channel overrides, or submission-ready Sent payloads.
messaging-performance-analyzer
sentdm/sent-plugin
Analyzes Sent message delivery, webhook, and activity data to explain funnel drop-offs, delivery failures, read-rate gaps, channel fallback, and suspicious performance changes. Use when a user says MDR, delivery report, message activity, webhook event, failed messages, low delivery rate, RCS fallback, WhatsApp read rate, SMS filtering, campaign performance, or asks why messages did not arrive.
rcs-agent-onboarding
sentdm/sent-plugin
Guides current Sent RCS and RBM onboarding, launch evidence, carrier approval, text and suggestion-chip templates, Sender Profile readiness, and safe routing. Use for RCS launch, fallback, pinned-channel tests, or broadcast prevention.
sms-10dlc-registration
sentdm/sent-plugin
Prepares and validates Sent US A2P 10DLC brand and campaign registration through Sender Profiles, including inheritance, all campaign use cases, opt-in evidence, sample-message policy, autoresponses, sandbox validation, TCR status, and rejection remediation.
template-builder-ui
sentdm/sent-plugin
Designs and audits tenant-facing Sent template builders, previews, validation, lifecycle UX, and API payload mapping. Use for template editor forms, variables, channel overrides, WhatsApp review, RCS suggestion chips, authentication templates, and safe submission flows.
Popular data & databases skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pgcron, pgmq), vector/semantic search (pgvector), and restoring dumps (pgrestore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-client-api
prisma/skills
Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".
prisma-database-setup
prisma/skills
Deprecated compatibility name for prisma-orm-setup. Use only when a user or existing integration explicitly invokes prisma-database-setup; otherwise select prisma-orm-setup.
prisma-cli
prisma/skills
Prisma ORM 7 CLI reference for existing Prisma 7 applications or explicitly selected Prisma 7 workflows. Covers prisma init, generate, migrate, db, dev, studio, and mcp. For setup, connection repair, or Prisma 8, use prisma-orm-setup; not the Prisma Platform CLI.
prisma-postgres
prisma/skills
Deprecated compatibility name for prisma-postgres-setup. Use only when a user or existing integration explicitly invokes prisma-postgres; otherwise select prisma-postgres-setup.
prisma-driver-adapter-implementation
prisma/skills
Required reference for Prisma ORM 7 SQL driver adapter work. Use when implementing or modifying adapters, adding database drivers, or touching SqlDriverAdapter, Transaction, savepoint, result mapping, or DriverAdapterError behavior. Covers current transaction lifecycle, optional savepoint hooks, original database-error preservation, and verification.