There is no WhatsApp API sandbox

Meta's test number is the closest thing, and it is not a sandbox. Here is what it actually does, why yours stopped working, and how to get a real message onto a real phone in about two minutes instead.

Is there a WhatsApp API sandbox?

Not in the sense other APIs mean it. Meta gives a developer app a test number, which is the nearest equivalent: it messages only recipients you add and verify by code — usually up to five — and it sends the pre-approved hello_world template. Nothing is simulated. Every message is delivered or it fails.

So the thing people are usually looking for — an environment where you can send freely to any number and inspect what would have gone out — does not exist on this platform, from Meta or from anybody reselling it. WhatsApp is a network of real people's phones and the opt-in is the product.

What Meta's test number is, stated fairly

• A number Meta creates with your developer app. It is not yours, it carries no brand name, and it cannot be moved to production.
• It sends to a short list of recipients you verify by code, commonly five. A number not on the list silently is not a number you can reach.
• It starts with the hello_world template. Free text works only inside a 24-hour window opened by the other person messaging you first.
• The access token offered in the dashboard is temporary. Rebuilding against it and coming back a day later is the most common way a working integration "breaks".

It is a good thing and it is doing its job: letting you prove the HTTP shape of a Cloud API call before you commit a business to the platform. What it is not is a way to run something small in production.

Why your test number stopped working

What to use instead: three real sends, no allowlist

Jabee has no sandbox for the same reason it has no number for you to register: the sender and the Meta-approved template are already ours. The first three sends are free, they go out on the production sender, and they land on your own verified phone.

1. Make a key

In the dashboard, Management → Approvals → New key. It begins jak_ and is shown once.

2. Verify the phone that will get it

On the Alerts screen, under Where alerts go, tap the link and send the message that opens. That is the whole check — the number is never typed in, and WhatsApp tells us which handset it came from. The account owner's phone is already verified, so this step is for pointing alerts somewhere else.

3. Send a real one

curl -X POST https://api.jabee.ai/api/v1/alerts \
  -H "Authorization: Bearer $JABEE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Nightly build failed",
    "body": "main @ 4f2a9c. Three tests red in billing.",
    "url": "https://ci.example/runs/8821"
  }'

It arrives in about a second. No template to write, no business verification, no allowlist of five.

The three routes, side by side

"WhatsApp API for personal use"

Said plainly, because it is the search that brings people here and the honest answer costs us a sale: for one line a week to your own phone, do not pay for this. CallMeBot publishes a free API for exactly that, and its own page says the free one is for personal use; ntfy is free, open source and self-hostable if you would rather not use WhatsApp at all.

Jabee starts to earn $29 when something comes back the other way:

• A decision has to return. Approve, Skip, or Edit with free text, read back by your own code — the Approvals API.
• Silence is the failure. A job that never ran raises nothing to notify about, which is what heartbeat checks are for.
• An agent should ask first. npx @jabee/mcp puts that in your MCP client — see the three kinds of WhatsApp MCP.
• Several systems alert and none of them should hold a number open. Grafana, Uptime Kuma, cron, GitHub Actions.

What the free three will not show you

• Load. Three sends prove the shape, not the limits: 200 new requests per business in any 24 hours, 60 API calls a minute per key.
• The quality rules. Three notifications in a row that nobody opens and we stop sending to that handset, with an email to the account owner. One message from the phone starts it again.
• Reaching anybody but your own people. That is refused, by design. A shared sender messaging strangers is how senders get banned.

Questions

Can I send to any number with the test number?

No. Only recipients you have added and verified by code, commonly five of them. The API returns success for a message to anybody else, which is why it reads as a bug rather than a restriction.

Is there a sandbox that simulates delivery?

No, and not from any reseller either — they all sit on the same Cloud API. If you need to test your own code without sending, point it at your own HTTP stub; the request shape is in the alerts documentation.

Do I need business verification to try Jabee?

No. The sender is ours. Business verification matters when you want your own number and brand name on the messages, which is a different product — the assistant.

What counts as one of the three free sends?

Any delivered alert or approval request. A retry carrying an external_id you have already used returns the original request and does not count again.