Concepts

Signup Links

Signup Links are shareable URLs that trigger the WhatsApp Embedded Signup flow when visited. You create a link in the Dashboard or via API, share it with your end-users (e.g., via email, SMS, or your onboarding flow), and when they click it and complete the flow, their WhatsApp number is automatically connected to your account.

The link resolves to a public page hosted by Muchaw DEV that handles the full flow — no additional frontend code needed.

$curl -X POST https://dev.muchau.com.br/api/signup-links \
>  -H "Authorization: Bearer $MUCHAW_API_KEY" \
>  -H "Content-Type: application/json" \
>  -d '{
>    "name": "Onboarding Flow",
>    "customMessage": "Connect your WhatsApp to start receiving notifications.",
>    "redirectUrl": "https://your-app.com/onboarding/success",
>    "maxUsages": 1,
>    "expiresAt": "2024-12-31T23:59:59Z"
>  }'

Response:

1{
2  "id": "sl_01j...",
3  "slug": "abc123",
4  "name": "Onboarding Flow",
5  "url": "https://connect.muchaw.dev/abc123",
6  "active": true,
7  "usageCount": 0,
8  "maxUsages": 1,
9  "expiresAt": "2024-12-31T23:59:59.000Z",
10  "customMessage": "Connect your WhatsApp to start receiving notifications.",
11  "redirectUrl": "https://your-app.com/onboarding/success",
12  "createdAt": "2024-01-15T10:00:00.000Z",
13  "updatedAt": "2024-01-15T10:00:00.000Z"
14}

Share the url field with your end-users.

Configuration options

FieldDescription
nameInternal label for the link (not shown to end-users)
slugCustom URL slug (auto-generated if not provided). Must be lowercase alphanumeric + hyphens.
maxUsagesMaximum number of times the link can be used. null = unlimited.
expiresAtISO 8601 datetime after which the link becomes inactive. null = never expires.
customMessageMessage shown on the signup page above the connect button.
redirectUrlURL to redirect users to after successful signup.
$# List all links
$curl "https://dev.muchau.com.br/api/signup-links" \
>  -H "Authorization: Bearer $MUCHAW_API_KEY"
$
$# Update a link
$curl -X PUT "https://dev.muchau.com.br/api/signup-links/<id>" \
>  -H "Authorization: Bearer $MUCHAW_API_KEY" \
>  -H "Content-Type: application/json" \
>  -d '{ "active": false }'
$
$# Delete a link
$curl -X DELETE "https://dev.muchau.com.br/api/signup-links/<id>" \
>  -H "Authorization: Bearer $MUCHAW_API_KEY"

How the public flow works

When an end-user visits https://connect.muchaw.dev/<slug>:

  1. The page fetches the link config via GET /api/signup-links/by-slug/<slug> (public, no auth)
  2. The Facebook Embedded Signup popup opens
  3. The user completes the flow and the page calls POST /api/signup-links/by-slug/<slug>/complete with the authorization code
  4. Muchaw DEV provisions the number automatically
  5. The user is redirected to redirectUrl (if configured)