WhatsApp for Frappe CRM, in development.

RightCurve is building a way for a business to connect its own WhatsApp Business account to Frappe CRM and handle conversations from its Lead and Deal records.

Ask about the pilot

Limited pilot, not yet connected to live Meta or Frappe accounts. Intended for businesses using Frappe CRM with the Frappe WhatsApp app.

How the proposed onboarding works

Grant access in Meta's own windowClick Connect WhatsApp Business account. Meta's Embedded Signup lets you choose the business, WhatsApp Business account and phone number to share. RightCurve never sees your Facebook password.
Review what you authorisedRightCurve verifies the grant with Meta and shows you the business, account, phone number, verified name and the exact permissions granted — before anything is configured.
Connect Frappe CRMGive RightCurve your Frappe site URL and an API key. It creates the WhatsApp Account record in Frappe and sets it as default. Frappe receives a RightCurve credential, not your Meta token.
Handle conversations on the Lead or DealIncoming WhatsApp messages appear in the Lead's WhatsApp tab; replies go out from the same tab. Delivery and read status flow back automatically.

What runs where

Customer's WhatsApp ──▶ Meta Cloud API ──▶ RightCurve  ── verified & de-duplicated ──▶ your Frappe site
                                             (/webhooks/meta)                         (frappe_whatsapp webhook)

Frappe CRM Lead page ──▶ your Frappe site ──▶ RightCurve Graph proxy ──▶ Meta Cloud API ──▶ Customer's WhatsApp
                         (WhatsApp Account:      (/graph/<client>/…,
                          url = RightCurve,       uses your encrypted grant)
                          token = RightCurve key)

Security and data handling

Your Meta access token: Obtained through Embedded Signup, scoped to the account you selected, stored encrypted at rest by RightCurve, never displayed and never written to your Frappe site or to logs.
What Frappe stores: A RightCurve client key and the RightCurve proxy address. In the pilot code, revoking the grant stops proxy requests for that grant; it does not erase stored records.
Webhooks: Every event from Meta is checked against Meta's signature; repeated deliveries are dropped; relays to your site carry a RightCurve signature you can verify.
Message content: Relayed to your Frappe site and not retained by RightCurve beyond the event identifiers needed for de-duplication and an audit trail without message bodies.
Revocation: On the review page, or by removing RightCurve from your WhatsApp Business account in Meta Business Manager.

Status: pilot, test accounts only

What is implemented in the isolated pilot code: an Embedded Signup path, checks of the granted account and number, a review-and-confirm step, configuration of Frappe CRM (Frappe WhatsApp app) over its REST API, a signature-verified and de-duplicated webhook relay, a Graph API proxy for outbound messages and template management, encrypted token storage and revocation.

What has been tested so far: all of the above against local stand-ins for Meta's Graph API and the Frappe WhatsApp app, with an automated test suite. The same code has not yet been exercised against Meta's live API or a live Frappe CRM site: that requires Meta to complete Tech Provider access verification and App Review for RIGHTCURVE LLP's app. Until then no client accounts are onboarded and no messages are sent.

Contact: RIGHTCURVE LLP, Singapore. Email rightcurve.sg@gmail.com.