WAHA 2026.7 - Passkey Pairing, Scoped Keys, Reachout Timelock
🔑 Passkey Pairing (GOWS)
WhatsApp started asking for a passkey on some accounts when you link a device - the session stops at PASSKEY_REQUIRED and waits instead of going to WORKING.
WAHA now handles it! Pair such sessions right from the 📊 Dashboard (with the WAHA browser extension), or build the flow into your own UI with two API calls:
GET /api/{session}/auth/passkey
POST /api/{session}/auth/passkey
We wrote a full guide on how it works and how to handle it from your own branded UI: How to Handle Passkey
⏳ Reachout Timelock
WhatsApp shadow-restricts accounts that message too many new contacts - sending fails with server returned error 463 while the session looks perfectly fine.
WAHA now exposes the Reachout Timelock state, so you can detect it and stop your campaigns in time (do NOT restart or re-pair the session - it lifts automatically!)
You also get it in the me.reachoutTimelock field in GET /api/sessions and GET /api/sessions/{session}/me.
Available in GOWS, NOWEB and WEBJS!
Read more: ⏳ Reachout Timelock — #2166
🔒 Scoped Session Keys
Need to put a media URL in an <img> tag or show a QR code in a browser - but don’t want to expose your real WAHA_API_KEY?
You can now mint narrow keys locked to one action for one session!
The media key can only download the session’s files, the control key can only open QR code and screenshot. MCP uses them internally now, so your real API key never leaks into an AI client transcript!
Read more: 🔒 Scoped Session Keys — #2146
🆕 Changelog
Check out the full list of updates in the 🆕 WAHA 2026.7 Changelog and stay tuned for more!
