# Blasty

> Blasty is a WhatsApp blasting service with an AI shared inbox, built for Malaysian businesses.
> Blast from the WhatsApp number you already use by scanning a QR code (no Business API approval needed),
> or from a number on Meta's official WhatsApp Cloud API; both run side by side. Replies land in a shared
> inbox where an AI agent answers around the clock. Every message costs one credit (RM0.02),
> on QR and Meta numbers alike. Start free with 50 credits; credits never expire.

## Pricing

Live: this file is generated from the current price list.

- 1 credit = 1 message sent = RM0.02, on QR and Meta numbers alike, on every plan.
  1,000 messages = RM20.00 · 10,000 = RM200.00 · 50,000 = RM1,000.00.
- New accounts get 50 free credits. Top up any amount from 100 credits (RM2.00); credits never expire.
- A blast to a WhatsApp group chat costs 1 credit per group, however many members it has.
- On Meta Cloud API numbers, Meta bills its own messaging fees to your business on top.
- Charged in MYR, secure checkout by Chip. Paid plans are paid per cycle and add numbers,
  features and monthly credits; messages cost the same on every plan.

### Plans

- **Free**: free — Default plan for every account.
  - Limits: 1 number, 500 contacts, 1 AI agent
  - Credits: 50 free to start
  - Includes: Campaigns & bulk send, AI agents & auto-reply, Media attachments
  - Not included: Device warmer, API access, Team members & shared inbox, Facebook & Instagram chats, AI agent tools, Keyword auto-replies, Reminders & recurring campaigns, Click tracking, A/B test campaigns
- **Pro**: RM30.00 per 30 days
  - Limits: 10 numbers, unlimited contacts, 10 AI agents
  - Credits: 3,000 included every month
  - Includes: Campaigns & bulk send, AI agents & auto-reply, Media attachments, Device warmer, API access, AI agent tools, Keyword auto-replies, Reminders & recurring campaigns, Click tracking, A/B test campaigns
  - Not included: Team members & shared inbox, Facebook & Instagram chats
- **Max**: RM50.00 per 30 days
  - Limits: 50 numbers, unlimited contacts, unlimited AI agents, unlimited team members
  - Credits: 5,000 included every month
  - Includes: Campaigns & bulk send, AI agents & auto-reply, Media attachments, Device warmer, API access, Team members & shared inbox, Facebook & Instagram chats, AI agent tools, Keyword auto-replies, Reminders & recurring campaigns, Click tracking, A/B test campaigns

## What you can do

Some features depend on the plan (see Pricing).

- Numbers: link WhatsApp numbers by QR code (like WhatsApp Web), connect numbers on Meta's official Cloud
  API, and connect Facebook Pages and Instagram accounts to the inbox (Messenger and Instagram DMs).
- Campaigns: personalised blasts to contact groups, smart segments or WhatsApp group chats; send now or
  schedule; pause, resume or stop while sending; A/B tests; click tracking; retarget people by funnel stage.
- Contacts: groups, rule-based smart segments, custom attributes as merge fields, CSV import and export.
- Templates & media: reusable templates, Meta templates created in Blasty with approvals synced from
  Meta, and image, video and document attachments.
- Automation: drip sequences, date reminders (birthdays, renewals), recurring campaigns, keyword
  auto-replies, away messages outside business hours, chat links and QR codes with ad attribution.
- AI agents: instructions plus a knowledge base (written or scanned from a website) answer chats around the
  clock, call your own HTTPS tools, hand off to a person, and summarise conversations.
- Shared inbox: every number's chats in one place, team members with roles, assignment, labels, unread state.
- OneClick OTP: verify a phone number over WhatsApp, by a code we send or a code the user sends us.
- Safety: device warmer and health guard for QR numbers, paced sending, STOP/START opt-out.

## Using the API

- Base URL: https://blasty.my/api/v1 (JSON; send `Accept: application/json`).
- Auth: `Authorization: Bearer <token>`. Create a key in the dashboard at https://blasty.my/tokens. A key can be
  pinned to one number: it then sends only from that number and sees only its messages, campaigns and OTPs.
- The API needs a plan with API access; otherwise every call answers 403.
- Sending (`messages/send`, `messages/bulk`, `campaigns`, `otp`, sequence enrolments) needs a verified
  email on the key's owner (403 otherwise).
- Credits are charged up front. A balance that can't cover the whole request answers 402 and nothing is sent.
- Full docs with request examples: https://blasty.my/api-docs

### MCP server

- Discovery document: https://blasty.my/mcp.json. It wraps the same REST API; authenticate with the same bearer token.

## API reference

Paths are relative to https://blasty.my/api/v1.

- Connection
  - `GET connection/status`: every linked number with its `driver` (`wwebjs` = QR, `meta` = Cloud API) and status
  - `GET connection/qr?device=<id>`: login QR (data URL) to link a QR number
- Messages
  - `GET messages`: message log, newest first (filter `status`, `campaign_id`; `per_page`)
  - `GET messages/{id}`: one message: `status` (`pending`, `sent`, `failed`, `cancelled`), `delivered_at`, `read_at`, `replied_at`
  - `POST messages/send`: queue one message (`phone`, `body` and/or `media_url`, optional `device_id`); 202
  - `POST messages/bulk`: queue up to 1,000 `messages`; answers per-item `queued` and `rejected`
- Campaigns
  - `GET campaigns`: campaign log, newest first
  - `GET campaigns/{id}`: one campaign with a `stats` funnel (sent, delivered, read, replied, clicked)
  - `POST campaigns`: send to `contact_group_id`, `contact_ids`, inline `recipients` and/or `retarget`, with a
    `body` or `message_template_id`; `scheduled_at` (ISO 8601) sends it later, credits reserved now
  - `POST campaigns/{id}/pause`, `POST campaigns/{id}/resume`
  - `POST campaigns/{id}/cancel`: cancel a scheduled campaign or stop a running one; everything unsent is refunded
- Drip sequences (built in the dashboard)
  - `GET sequences`
  - `POST sequences/{id}/enrollments`: enrol `contact_ids` / inline `recipients` (1 credit per step, when it sends)
  - `DELETE sequences/{id}/enrollments/{contact_id}`: take a contact out
- OneClick OTP
  - `POST otp`: start a verification; `mode` `normal` (we send a code to `phone`) or `reverse` (a wa.me link the user sends)
  - `GET otp/{id}`: status
  - `POST otp/{id}/verify`: check a `code` (normal mode)
- Contacts
  - `GET contacts` (`search`, `external_id`), `POST contacts` (upsert on the normalised phone),
    `GET|PUT|DELETE contacts/{id}`
- Templates
  - `GET templates` (`active_only=1`), `POST templates`, `GET|PUT|DELETE templates/{id}`

## Webhooks

No polling needed: set one URL per account in the dashboard (https://blasty.my/settings/webhooks). Each event is
POSTed as `{id, event, created_at, data}`, signed `X-Blasty-Signature: sha256=<HMAC-SHA256 of the raw body>`
with the account signing secret. Answer 2xx (failures are retried 3 times); dedupe on `id`.

- `message.sent`: WhatsApp accepted an outgoing message
- `message.failed`: An outgoing message failed for good
- `message.delivered`: An outgoing message reached the phone
- `message.read`: The recipient read an outgoing message
- `message.received`: A message came in on one of your numbers
- `campaign.completed`: A campaign finished sending
- `campaign.paused`: A running campaign was paused (by you, or by the device health guard)
- `campaign.resumed`: A paused campaign carried on sending
- `campaign.stopped`: A running campaign was stopped; its unsent messages were refunded
- `contact.opted_out`: A contact opted out of marketing (e.g. replied STOP)
- `contact.opted_in`: A contact opted back in (e.g. replied START)
- `chat.handoff`: A chat was handed from the AI agent to a person
- `chat.assigned`: A chat was assigned to a team member (or unassigned)
- `credits.low`: Your credit balance dropped below your low-credit alert
- `keyword.matched`: A message matched a keyword auto-reply rule
- `device.unhealthy`: A number looked like a ban risk, so its campaigns and drips were paused
- `link.clicked`: Someone clicked a tracked link in a campaign or drip message (first click per message)

## Notes for agents

- Phone numbers must parse as Malaysian numbers (e.g. `0123456789` or `60123456789`).
- Each message costs one credit (RM0.02); check the balance before bulk sends.
  Campaigns are all-or-nothing: charged for every recipient up front.
- Merge fields use single braces: `{name}`, `{phone}`, or any contact attribute such as `{plan}`.
- Scheduled times without an offset are Malaysia time (Asia/Kuala_Lumpur), up to 30 days ahead.
- On a Meta Cloud API number, campaigns must use a template approved by Meta, and free text only reaches
  people who messaged that number in the last 24 hours.
- Respect `opted_out`. Campaigns, sequences and bulk sends skip opted-out contacts automatically (bulk
  rejects them with `reason: opted_out`); people opt out by replying STOP/BERHENTI and back in with START/MULA.
- A message whose `channel` is `messenger` or `instagram` is a Facebook/Instagram chat, not WhatsApp; its
  `recipient` is a Meta id (`fb:…` / `ig:…`), not a phone number.

## More

- Pricing: https://blasty.my/#pricing
- Affiliate program: https://blasty.my/affiliates
- Terms of Service: https://blasty.my/terms
- Privacy Policy: https://blasty.my/privacy