Omry atia's Projects

Secure WAHA for Railway with API auth, storage, and webhooks

WAHA Secure with Webhook

API key used to secure WAHA’s REST API. Clients must send it in the X-Api-Key header. WAHA accepts either a plain secret or a sha512:-prefixed hash, and the hash form is the recommended production setup.

Base URL used to build the media.url field in webhook events. 

Enables or disables the built-in WAHA dashboard login UI. This is separate from API-key auth.

Password for the WAHA dashboard login. Use a generated value instead of example/default credentials.

Username for the WAHA dashboard login. Use a generated value instead of example/default credentials.

Comma-separated list of webhook events to send. message subscribes only to message events; WAHA docs warn that subscribing to * or all events can generate a large number of requests in production.

Webhook destination WAHA posts events to. The official docs document this setting as WHATSAPP_HOOK_URL; it defines where subscribed webhook events are delivered.

Base directory for local WAHA session storage. This is where session state is kept when using local storage, and persistent storage is required if you want sessions to survive redeploys without rescanning QR codes.

Controls log output format. PRETTY is the default and is easier locally, while JSON is better for centralized log processing.

Controls log verbosity. Supported levels are error, warn, info, debug, and trace; WAHA docs warn against debug and trace in production because they generate excessive logs.

Selects where incoming media files are stored. WAHA supports local file storage, S3 storage, and PostgreSQL-backed media storage.

Controls whether login QR codes are printed into the service logs. Set it to False to keep Railway logs cleaner.

Restarts saved/stopped sessions after container restart. WAHA’s docs describe this behavior under WHATSAPP_RESTART_ALL_SESSIONS; if your image supports the WAHA_ alias, the meaning is the same.

Default WhatsApp engine for sessions. Supported values are WEBJS, NOWEB, and GOWS; the documented default is WEBJS.

Local directory where downloaded WhatsApp media files are stored. Persist this path on a volume if you want files to survive restarts and redeploys.

Number of seconds media files are kept before cleanup. Set it to 0 to disable automatic deletion.

Session name, or comma-separated session names, that WAHA should auto-start on launch.

Enables or disables the built-in Swagger UI. This protects the docs panel only and does not replace API-key auth.

Password for Swagger UI login. Use a generated value instead of example/default credentials.

Username for Swagger UI login. Use a generated value instead of example/default credentials.