Glossary · 35 terms
Security & identity
How messaging integrations stay secure: webhook signatures, TLS and end-to-end encryption, secrets and token rotation, OAuth and single sign-on, role-based access and the audits and certifications that prove it.
Foundation· 9
Start here — the concepts everything else builds on.
- API KeyA long random secret a messaging provider issues so your server can authenticate its API calls; whoever holds the key can act as your account.Read definition
- Encryption at RestEncrypting data where it is stored, such as databases, media files and backups, so a stolen disk, snapshot or dump is unreadable without the keys.Read definition
- End-to-End EncryptionE2EEEncryption in which only the two endpoints of a conversation hold the keys, so servers that relay messages cannot read them; WhatsApp uses it by default.Read definition
- ISO/IEC 27001The international standard for an information security management system (ISMS); certification shows an audited, risk-based way of managing security.Read definition
- PhishingFake messages, links and lookalike accounts that impersonate a trusted brand to trick people into handing over OTPs, payments or logins.Read definition
- Single Sign-OnSSOSigning in once with a company identity provider to reach many apps, so staff access is granted, reviewed and revoked in one place.Read definition
- SOC 2An independent CPA's report on how well a service provider's controls meet the AICPA Trust Services Criteria, at a point in time or over a period.Read definition
- Transport Layer SecurityTLSThe protocol that encrypts and authenticates each network connection — the S in HTTPS — protecting API calls and webhooks in transit.Read definition
- Two-Factor Authentication2FAA login that needs a second proof besides the password — an authenticator code, security key or passkey — so a stolen password is not enough.Read definition
Practitioner· 20
What you need once you are running it day to day.
- Account TakeoverATOAccount takeover (ATO) is an attacker gaining control of someone else's account, such as a Meta admin login or a WhatsApp number, and acting as its owner.Read definition
- App SecretThe confidential key of a Meta developer app that signs webhook deliveries, computes appsecret_proof and exchanges login codes; it must stay on your server.Read definition
- Audit LogAn append-only record of who did what, when and from where in a system, kept for investigations and to prove accountability to customers and regulators.Read definition
- Brute-Force AttackAn automated attack that guesses passwords, PINs or one-time codes over and over until one works; attempt limits and short code lifetimes defeat it.Read definition
- CERT-In DirectionsIndia's April 2022 cyber security directions requiring organisations to report listed cyber incidents to CERT-In within six hours and keep 180 days of logs.Read definition
- Hash-Based Message Authentication CodeHMACA keyed hash that proves a message came from someone holding a shared secret and was not changed; HMAC-SHA256 signs webhooks and API requests.Read definition
- JSON Web TokenJWTA compact signed token of three Base64url parts (header, claims, signature) that lets a server verify a request's identity without a database lookup.Read definition
- OAuth 2.0An authorisation framework that lets an app act on someone's account through a scoped, revocable access token instead of their password.Read definition
- OpenID ConnectOIDCAn identity layer on top of OAuth 2.0 that returns a signed ID token saying who the user is, used for single sign-on and sign-in-with buttons.Read definition
- OWASP Top 10OWASP's ranked list of the most critical web application security risks, led by broken access control and used as a baseline for secure development.Read definition
- PasskeyA phishing-resistant sign-in credential: a key pair kept on your device or in your password manager, unlocked with a fingerprint, face or screen lock.Read definition
- PCI DSSThe Payment Card Industry Data Security Standard: the security rules for anyone who stores, processes or transmits payment card data.Read definition
- PII MaskingReplacing personal data such as phone numbers, names and emails with partly hidden values in logs, agent screens, exports and AI prompts.Read definition
- PIN VerificationThe six-digit two-step verification PIN that must be supplied whenever a WhatsApp Business phone number is registered on the Cloud API.Read definition
- Principle of Least PrivilegePoLPGiving every person, system user and service only the permissions it needs, for only as long as it needs them, so one mistake or leak stays small.Read definition
- Role-Based Access ControlRBACGranting permissions to roles such as admin, developer, agent and analyst, then assigning people to roles, instead of setting permissions person by person.Read definition
- Secrets ManagementThe practice of keeping API tokens, app secrets and keys in a controlled vault, injecting them at runtime and auditing who can read them.Read definition
- SIM Swap FraudA takeover in which a criminal gets a victim's mobile number moved to a new SIM, then receives their SMS OTPs and re-registers their accounts.Read definition
- Token RotationReplacing access tokens, app secrets and API keys on a schedule or after exposure, with an overlap so services switch over without downtime.Read definition
- X-Hub-Signature-256The header on every Meta webhook POST: sha256= plus an HMAC-SHA256 of the raw body keyed with your app secret, proving the event is genuine.Read definition
Expert· 6
Edge cases, internals and the details that matter at scale.
- App Secret Proof (appsecret_proof)A Graph API parameter holding an HMAC-SHA256 of the access token keyed with the app secret, so a stolen token cannot be used without the secret.Read definition
- Key ManagementKMSGenerating, storing, rotating and revoking the encryption keys that protect your data, usually inside a key management service (KMS) or an HSM.Read definition
- Replay AttackCapturing a valid, correctly signed request, such as a webhook delivery or an API call, and resending it later so the receiver acts on it again.Read definition
- Security Assertion Markup LanguageSAMLAn XML standard that lets an identity provider vouch for a signed-in user to another application by sending it a digitally signed assertion.Read definition
- Signal ProtocolThe open end-to-end encryption protocol WhatsApp uses: X3DH key agreement plus the Double Ratchet, which gives every message its own key.Read definition
- Webhook mTLS (Mutual TLS)Requiring Meta's client certificate in the TLS handshake on your webhook endpoint, so only Meta's servers can connect before any payload is read.Read definition
Put these terms to work.
Go live on the official WhatsApp Business API in 2 hours with a 7-day free trial — no card required.
7-day free trial Enterprise-grade reliability Live in 2 hours Built for Indian businesses