Skip to main content
Every account can send from the first minute. Two things change as an account proves who it is: which phone numbers it may reach on the carrier channels, and how much it may send per day.

Account levels

Business verification is never required to send. It gates 10DLC registration only, because carriers register a brand against a vetted legal entity. Accounts created before 24 August 2026 start at Verified.

Verifying a phone number

An unverified account can text and call the numbers it has verified. A number is verified from the phone itself, which is what makes the check mean something:
  1. In the dashboard, go to Sandbox and click Generate Verification Code.
  2. Scan the QR code or click Open WhatsApp on the phone you want to verify.
  3. Send the pre-filled VERIFY- message to Zavu’s sandbox number.
The number is marked verified automatically. One verification covers WhatsApp, SMS and calls. Up to 5 numbers per project; a code expires after 10 minutes. There is nothing to type into the dashboard, no API call, and no support ticket.

Sending to any number

Do any one of these in the dashboard. Each is self-serve:
  • Verify your identity under Identity verification (/kyc): an ID document and a selfie, a few minutes.
  • Add a payment method under Billing: about half a minute. Nothing is charged.
  • Settle a deposit under Billing.
  • Subscribe to a paid plan.
Any one of them moves the account to Verified. From then on sms, sms_oneway and voice reach any destination.

Daily ceilings

Channels that share a budget share one counter. Counts reset at 00:00 UTC.
  • The SMS ceiling above Sandbox keys on identity, not on the level: an account that reached Verified by saving a card sends 200 a day until its identity or business verification is approved. A higher limit can be agreed for an account.
  • Email has no verification gate on single sends. A sender with a verified domain sends from day one, within the plan’s quota: 100 a day and 3,000 a month on Free.
  • A daily ceiling never reduces a monthly allowance: 100 a day on the conversational group still reaches the 2,000 messages a month Free includes.
  • Broadcasts count each recipient against the same ceiling. Recipients beyond it are marked failed with errorCode DAILY_LIMIT_EXCEEDED and are not retried the next day.

Monthly allowance on the app channels

whatsapp, telegram, instagram and messenger share one monthly allowance: 2,000 messages on Free. Paid plans have no message cap. The counter resets on the 1st at 00:00 UTC. It counts messages in both directions. A message a contact sends you consumes one unit exactly as a message you send them does. This is the part that surprises people: a project that has sent 300 messages and received 1,700 has used the whole allowance, and the figure on the dashboard will not match a count of your own sends. The plan card breaks the total into received and sent for that reason. What does not count:
  • Messages you send from the WhatsApp Business App on your own phone while coexistence is on. Meta mirrors them to Zavu so they appear in your inbox, but Zavu did not send them and does not count them.
  • Failed sends. An outbound message counts when it is accepted by the channel, not when it is created.
  • SMS, voice and email. Each is billed or metered on its own terms; see the daily ceilings above and your plan’s email quota.

What happens at the cap

On Free, both directions stop:
  • Sending is refused. POST /v1/messages answers 429 a2p_limit_exceeded, and so does every other way of sending: the dashboard composer, an inbox reply, a group reply, a reaction, an AI agent’s reply, and each remaining recipient of a broadcast (marked failed with errorCode A2P_LIMIT_EXCEEDED).
  • Receiving is refused too. An incoming message on those channels is not stored, does not appear in your inbox, and fires no message.inbound webhook. It is not delivered later when the month resets. We email the team the first time this happens in a month.
Sending and receiving resume on their own when the counter resets, or immediately on a paid plan.

Errors

a2p_limit_exceeded (429)

Returned by POST /v1/messages and POST /v1/messages/{messageId}/reactions when the month’s allowance on the app channels is spent. Free plans only: a paid plan is never refused for volume.
Distinct from daily_limit_exceeded, which clears at 00:00 UTC. This one clears on the 1st of the month, or the moment the account moves to a paid plan.

destination_not_verified (403)

Returned by POST /v1/messages on sms, sms_oneway and voice, and by POST /v1/calls, when an unverified account targets a number it has not verified.
Send to one of details.verifiedNumbers, verify the number you meant to reach, or move the account to Verified.

daily_limit_exceeded (429)

Returned by POST /v1/messages and POST /v1/calls when the channel group’s ceiling for today is spent.
details.limit is the ceiling that applied. Wait for 00:00 UTC, or raise it: identity verification or a payment method for the SMS, voice and conversational groups, a plan upgrade for email.

kyc_required (403) on broadcasts

POST /v1/broadcasts/{broadcastId}/send refuses an unverified account on every channel except whatsapp, where Meta’s approval of the template is the review. Any one of the four routes to Verified lifts it. Drafts can be created and edited without it.
See Broadcasts.

Test-mode keys

A zv_test_ key is separate from the levels above, and narrower than they are. Whatever the account has proven:
  • WhatsApp only. The key ignores your senders and sends from Zavu’s shared sandbox number. Any other channel is refused with 400 Sandbox mode only supports WhatsApp — including Telegram, Instagram, Messenger and email.
  • Only to a phone on your team. The recipient must be a team member’s phone number, confirmed in your account. Anything else is refused with 403.
  • No calls. POST /v1/calls refuses a test key with 400.
The messages are delivered for real — a test key changes who you can reach, not whether the message arrives.

Next Steps

Quickstart

Send your first message

Rate Limiting

Per-minute API request limits