How to post a status update in PHP with the Wapito WhatsApp API

<?php
// Post Status with the Wapito WhatsApp API.
//
// Post a text card, or upload media once and post it as an image, video or voice status with a caption that carries the detail.
//
// Run it with:
//   export WAPITO_TOKEN="wpt_..."
//   php post-status.php
require __DIR__ . '/vendor/autoload.php';

$baseUrl = 'https://api.wapito.com/v1';
$token = getenv('WAPITO_TOKEN');

// --- Post a text card ---
$client = new \GuzzleHttp\Client();

$response = $client->request('POST', $baseUrl . '/stories/text', [
  'body' => '{"body":"Workshop closed Friday for stocktake. Orders ship Monday.","background_color":"#0B7F5C","font":2,"contacts":["+15551234567","+15559876543"]}',
  'headers' => [
    'Authorization' => 'Bearer ' . $token,
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();

// --- Upload the image or video ---
$client = new \GuzzleHttp\Client();

$response = $client->request('POST', $baseUrl . '/media', [
  'body' => '{"data":"data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD…","filename":"new-colours.jpg"}',
  'headers' => [
    'Authorization' => 'Bearer ' . $token,
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();

// --- Post the media status ---
$client = new \GuzzleHttp\Client();

$response = $client->request('POST', $baseUrl . '/stories/media', [
  'body' => '{"media":"https://acme.example/status/new-colours.jpg","caption":"New colours, same price.","contacts":["+15551234567"]}',
  'headers' => [
    'Authorization' => 'Bearer ' . $token,
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();

// --- Post a voice status ---
$client = new \GuzzleHttp\Client();

$response = $client->request('POST', $baseUrl . '/stories/audio', [
  'body' => '{"media":"https://acme.example/status/monday-update.m4a","background_color":"#1D2B3A"}',
  'headers' => [
    'Authorization' => 'Bearer ' . $token,
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();

<?php
// public/webhook.php - run with: php -S 0.0.0.0:8000 -t public
require __DIR__ . '/../vendor/autoload.php';

use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use Slim\Factory\AppFactory;

$secret = getenv('WAPITO_WEBHOOK_SECRET');
$events = ['messages', 'messages.status'];

/** Checks the X-Wapito-Signature header: t=<ms>,v1=<hex hmac-sha256>. */
function wapito_verify(string $raw, ?string $header, string $secret): bool
{
    if (!$header) {
        return false;
    }
    $parts = [];
    foreach (explode(',', $header) as $pair) {
        [$k, $v] = array_pad(explode('=', $pair, 2), 2, null);
        $parts[$k] = $v;
    }
    if (empty($parts['t']) || empty($parts['v1'])) {
        return false;
    }
    if (abs((int) (microtime(true) * 1000) - (int) $parts['t']) > 300000) {
        return false; // 5 minute clock skew
    }
    $expected = hash_hmac('sha256', $parts['t'] . '.' . $raw, $secret);
    return hash_equals($expected, $parts['v1']);
}

$app = AppFactory::create();
$app->post('/wapito', function (Request $request, Response $response) use ($secret, $events) {
    $raw = (string) $request->getBody();
    if (!wapito_verify($raw, $request->getHeaderLine('X-Wapito-Signature'), $secret)) {
        return $response->withStatus(401);
    }
    $payload = json_decode($raw, true);
    if (in_array($payload['event'], $events, true)) {
        error_log($payload['event'] . ' ' . json_encode($payload['data']));
    }
    return $response->withStatus(200); // answer 2xx fast; do the real work in a queue
});
$app->run();