Automating a phone number you do not own: four invariants
If your product connects to WhatsApp through the linked-device protocol, your code operates a phone number that belongs to someone else. A small business owner scans a QR code and hands you their working line, the one printed on their van and saved in every customer's contacts. The cost of a mistake is not a 500 in your dashboard. It is a ban, and a ban is not something you can refund. Only the…
When you operate a phone number that does not belong to you, such as one used by a small business owner, there are several important rules to follow. The first rule is that automation should only react to incoming messages, never initiate actions. Automation that starts a session, requests a new QR code, clears stored credentials, or schedules queries on its own is considered suspect and can lead to a ban.
The code should look caring but behave like an unstable client, with a long cooldown between reconnect attempts and logging outcomes.
The second rule is that bulk lookups must converge. Resolving identifiers, mapping contacts and checking number existence must remember negative answers, have a ceiling per pass, and have a minimum interval between passes. Successive lookups for the same unresolvable numbers cause the query count to never drop, resembling scraping a contact database, which is banned. The fix is to record lookup results, including "not found," in a table with a ceiling limit and older than minimum interval.
The third rule is that a process restart should not touch every session. Deploys should stagger reconnects with a dozen seconds between attempts and no automatic connection for sessions without stored credentials. These credentials can only produce a QR request asked for by a human. A for loop should iterate over sessions, with a sleep function adding a random delay and void connect for sessions with stored credentials.
The fourth and final rule is that there are no silent touches. Every disconnect, reconnect, and re-authentication must be logged with a parsed reason, and the log must outlive the process that writes it. This hygiene practice becomes crucial when a number gets flagged for anti-fraud. The telemetry should be stored in a table, mounted on a volume, archived on rebuild, and costs nothing while preventing teams from blaming the messenger for their own restart loops.
To test your own code, ask what the provider sees if automation misfires ten times in a row on a live customer number. Ten replies, re-authentications, or queries about strangers are not fine. Implementing these rules can prevent businesses from losing their phone numbers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
