WAHA vs Evolution API: Which One Should You Actually Operate?

WAHA vs Evolution API: which one should you run?

Run WAHA for the smaller operating surface: one container, a dashboard, storage optional. Run Evolution API if ecosystem reach matters more and you accept PostgreSQL and Redis beside it. Neither ships send pacing, warming, duplicate suppression or search, so the deciding cost is the layer you write.

This is not a feature fight. Both put an unofficial WhatsApp Web session behind a REST API and outbound webhooks, on a number you own, with no Meta business verification and no per-message fee. WAHA's own quickstart, read as of November 2026, presents a single application container and lists sessions, sending, receiving, webhooks and a dashboard. Send pacing is not on that list. Neither is warming or a duplicate-content guard.

Three line items follow you through this entire comparison, and none appears on a pricing page:

1. Infrastructure you operate. Containers, databases, TLS, backups, and the hours they consume monthly.
2. Engine churn you inherit. Both sit on protocol libraries that move when WhatsApp moves, and no upgrade lands on your calendar.
3. The safety layer you write. Human-like pacing, per-number caps, new-number warming, duplicate suppression, risk scoring. None of it ships.

The table below puts five options on the two columns that settle this decision: what you must operate, and how you actually pay. It is the short version. The rest of this post prices each line item in turn, and names the date behind every number.

Do WAHA and Evolution API charge per message?

Neither charges per message. WAHA pairs a free core with a paid WAHA Plus tier; Evolution API is open source. No vendor sits in the message path, so nothing is metered. You pay for servers, databases and the hours to run them, and both carry the same structural ban exposure.

The contrast is the official route. The Cloud API is metered per message by category. Dated 2026 trackers, including Vectalk's month-by-month WhatsApp API changes and Manifest's dated update log, record a pricing change on 1 October 2026, and rates vary by category and market. Check the live rate card rather than a blog post, this one included. The structure is the stable part: the official route bills per message; self-hosted engines do not.

What self-hosting does not escape is behavioural risk. WhatsApp's Business Messaging Policy prohibits unauthorised automation and unsolicited messaging. Both projects drive an unofficial WhatsApp Web session that sits outside the sanctioned Cloud API route. Enforcement is discretionary and can arrive as a temporary limit or a permanent ban.

So the two projects differ in cost shape, not cost class. One sells a paid tier; the other carries a heavier infrastructure bill. Neither invoices you for the message, and neither absorbs the risk.

What do you actually have to operate?

Evolution API means Docker plus PostgreSQL plus Redis plus a TLS-terminating proxy, and you own the upgrades, backups and restarts of all four. WAHA compresses that to one application container with optional storage and a dashboard. Count services, not adjectives. That count is the recurring bill.

As of November 2026, Evolution API's documented Docker deployment starts the API, a PostgreSQL database and a Redis instance together, fronted by whatever proxy you add. Three services plus TLS, each with its own upgrade path and failure mode. Read the deployment documentation at the version you install and count them yourself.

WAHA's documentation presents one container as the default, with durable storage added only when you want it. The difference compounds at 2am, when containers restart in the wrong order and the API comes up before its database.

Infrastructure cost follows the service count. A VPS sized for the Evolution API stack, with headroom for backups and the managed PostgreSQL you will eventually want, costs more than a box sized for WAHA's single container. Check current host pricing for your region before you commit to a figure. The pattern is durable even as prices move.

One honest note: the official route meters and tiers throughput, which is part of why teams look here at all. A self-hosted engine posts no ceiling and offers no safety net for crossing one.

What does the anti-ban layer cost to build yourself?

Neither WAHA nor Evolution API ships randomised delays, pacing profiles, per-number rate caps, new-number warming, read-before-reply with a typing indicator, a duplicate-content guard or live risk scoring. Both are protocol bridges. The operator writes the safety logic, usually in the week after the first account scare.

There is no published benchmark for this work, so treat the following as an operator estimate, not a measured figure: a defensible first version, covering jitter, per-number caps, warming state, duplicate hashing and a risk score, runs to several hundred lines plus a state store and runbook, and typically absorbs weeks of engineering before it behaves well under load. The second version costs more, because it is written after an incident.

The build order repeats across operator accounts. Ship the integration. Send slightly too fast on a young number. Take a warning or a temporary restriction. Then add pacing, caps and warming under pressure, with no staging environment that resembles production. That sequence is the real price of the missing layer, paid in incidents rather than invoices.

WhatsApp's Business Messaging Policy treats unauthorised automation as a violation regardless of volume. A self-hosted engine hands you no equivalent throttle: no ceiling, and no safety net.

None of this is a knock on either project. Both are competent at what they set out to do. Safety is a deliverable, and someone has to deliver it.

Which updates break your setup, and who controls the schedule?

Evolution API sits on Baileys, the Node library implementing the WhatsApp Web protocol. WAHA runs multiple engine backends behind one API and tags releases by date. Upgrades land on the maintainer's schedule, not yours, and protocol drift does not wait for a change window.

As of November 2026, Baileys is working through a v7 release-candidate line on GitHub, and WAHA's release page carries date-stamped builds including 2026.10.1. A new major version can shift payload shapes, session handling and reconnection behaviour underneath your integration. Date-stamped versioning is convenient, and it also tells you how often you will be pulling.

Add the upstream clock. WhatsApp's platform changes steadily, and unofficial tooling absorbs that churn with no deprecation notices, no migration guide and no support line. In practice you re-test session linking and reconnection after every engine bump, because those are the failures that take the number offline rather than merely erroring.

The conclusion is about scheduling, not quality. A dependency you upgrade on your own calendar is maintenance. A dependency that stops working on a Tuesday because WhatsApp changed a frame is an outage, and it arrives without warning.

Where does message history live, and can you search it?

Evolution API persists conversations in the PostgreSQL you provisioned. WAHA's storage depends on the backend you configure; its November 2026 documentation covers local file, MongoDB and PostgreSQL. In both cases, full-text search across the archive, backfill after a gap and a transcript an AI can read are features you build on top.

Storage is not the hard part. Query is. A messages table is easy. What a support team or an agent needs is search across years of text, retrieval after a reconnect gap, and a transcript formatted for a model's context window. Each is a small project with an owner and a maintenance tail.

The repository choice carries an operational cost of its own: PostgreSQL is a fourth service in the Evolution API stack, with backups and version upgrades attached. WAHA's optional store keeps the stack minimal until durability matters, at which point you are running a database again.

For comparison, SocialMate keeps chats and contacts in local storage on your machine, with Pro adding unlimited full-text search, a full message cache with replay on reconnect, and a one-shot backfill on upgrade. Free is live-only: it receives events but cannot query the archive. SocialMate vs self-hosted APIs puts that beside both engines. The argument here is narrower: in WAHA and Evolution API, this layer is yours to specify.

Do WAHA or Evolution API work with n8n, Chatwoot or an AI agent?

Yes, in the sense that both expose a REST API and outbound webhooks, so any tool that makes an HTTP call can be wired to them. The wiring is the work: HTTP Request and Webhook nodes, a publicly reachable inbound URL, retries, and key or signature handling you maintain yourself.

You either build that plumbing or depend on community packages with their own maintenance question. Chatwoot and custom agents follow the same pattern, and a stable inbound URL is your problem to solve with a tunnel, a VPS or a reverse proxy.

SocialMate takes a different route at this layer, and the specifics are checkable. Its n8n community node, n8n-nodes-socialmate, is at version 2.7.0 with a scope-aware credential, an action node, a trigger node, and every operation exposed as an n8n AI-Agent tool. Its native socialmate-mcp server exposes 44 WhatsApp tools over the Model Context Protocol, so Claude Desktop, Cursor or Cline can drive WhatsApp directly. MCP is an open protocol surface, not a per-service connector, and it has no inbound push: the n8n trigger or a webhook remains the event source.

The API tier split is the detail that decides most developer evaluations. On Free you get read endpoints, plain text send, quoted replies, reactions, mark-as-read and the typing indicator, two webhook endpoints and 9 of the 35 webhook events. Pro adds media, groups, polls, locations, contact cards, scheduled messages, the smart queue, a stable named tunnel and unlimited webhooks.

Read every endpoint and recipe in the docs before deciding. If you enjoy building glue, the engines give you a clean surface. If the glue is the tax you were trying to avoid, list it as a line item.

Which should you pick: WAHA, Evolution API, or neither?

Pick WAHA if you want the smallest surface to run and will supply pacing, search and integration glue yourself. One container and a built-in dashboard mean fewer moving parts to patch, and multiple engine backends give you an escape hatch when one lags the protocol. Trade-off: a smaller ecosystem, so more surrounding tooling is yours to write.

Pick Evolution API if ecosystem reach matters more than infrastructure simplicity, and you accept PostgreSQL and Redis as first-class citizens. Trade-off: four services to patch, back up and restart in order, plus a Baileys dependency whose major versions arrive on someone else's schedule.

Pick neither if the missing pieces are exactly the pieces you did not want to own: human-like pacing, warming, duplicate protection, risk scoring, a GUI and searchable history. That is not a criticism of the engines. It is a statement that the work you were avoiding sits outside both of them, and choosing between the two does not move it.

Bans are possible with every option on this page, including the one below. No tool prevents them, and any source that says otherwise is selling something.

What is the self-hosted option with the pacing layer already written?

SocialMate keeps what this category is good at, self-hosting, your own number and no per-message fee, and ships the layer both engines leave to you. It runs locally, and chats and contacts stay in local storage on your machine. Nothing routes through SocialMate's servers.

The desktop app is the flagship, on Windows, macOS or Linux, connecting from your own residential IP, the same network as the phone that owns the number. That removes a risk factor; it does not make a ban impossible. For always-on work it also runs headless on a VPS through Docker or systemd, with a web admin console at /admin, and per-account proxy routing on Pro lets a server account egress through a residential or mobile proxy.

The safety stack ships rather than waits: randomised delays and jitter, Safe, Balanced and Fast pacing profiles, per-number rate limits, session warming, a real typing indicator and read receipts before replies, an adaptive throttle that slows as risk climbs, a duplicate-content guard, live risk scoring including cold-outreach detection, and risk-based auto-resume for cooled accounts. It is engineered risk reduction, not immunity.

On price, it is a flat licence with no per-message fee and no Meta approval. Free is $0 forever, up to 200 messages a day on one account. Pro is $99 a year or $10 a month, one device included, extra seats $4 a month each, starting at a safe 500 a day per account and scaling to 5,000 a day per account through High-Volume Mode after 72 hours of warming. WhatsApp accounts are unlimited on Pro, and a 7-day opt-in Pro trial is available. See the full pricing split, then download the free app and run the safety layer instead of writing it.

The honesty carries across. Higher volume is never safe on day one, and bans remain possible with any tool including this one. The job is messages to people who are already waiting on you: they ordered, they booked, they asked. Each send is paced individually, and identical text to many contacts is blocked by the duplicate-content guard. SocialMate's own terms are explicit that it is "not a bulk-messaging, broadcast, or spam platform." SocialMate is independent and not affiliated with, endorsed by, or partnered with WhatsApp or Meta.

Option	What it is	What you must operate	Pricing model	Ban / account risk
WAHA (WhatsApp HTTP API)	Self-hosted, unofficial WhatsApp REST API with a built-in dashboard and multiple engine backends	One application container plus a reverse proxy for TLS; a database only if you choose one. Pacing, history tooling and integration glue written by you.	Free core plus a paid WAHA Plus tier. You pay your own infrastructure. No per-message fee.	Unofficial protocol automation on your own number can be limited or banned. No tool prevents that, and WAHA makes no such guarantee.
Evolution API	Self-hosted, unofficial WhatsApp REST API built on Baileys, with a broad community ecosystem	Docker Compose running the API, PostgreSQL and Redis, plus a TLS-terminating proxy. Backups, upgrades and restart order are yours. Pacing and searchable history written by you.	Open-source licence, no vendor message fee. You pay server, PostgreSQL, Redis and the hours to run them. No per-message fee.	Same structural exposure. Unofficial automation can get a number limited or banned, and nothing in the stack changes that.
Baileys (raw library)	Open-source Node.js library implementing the WhatsApp Web protocol. A library, not a server.	Everything: your own service, HTTP endpoints, persistence, reconnection logic, TLS, monitoring and every safety guardrail.	Free library. All cost is engineering time plus your infrastructure. No per-message fee.	The same exposure with no abstraction between you and it. Every guardrail is code you wrote and must test.
Meta WhatsApp Cloud API (official)	Meta's sanctioned WhatsApp Business Platform, with business verification and approved message templates	Almost nothing operationally: Meta hosts it. You operate template approval, opt-in records and billing reconciliation.	Metered per message, with rates that vary by category and market; dated 2026 trackers record a pricing change on 1 October 2026. Check the live rate card.	It is the sanctioned route, which removes the policy violation, not the risk of enforcement for unsolicited or template-abusing messaging.
SocialMate	Self-hosted, no-approval WhatsApp automation app: desktop on your own machine, or headless on a VPS, with an engineered anti-ban pipeline	The machine you already own. Docker or systemd is optional on a server; the desktop app needs no DevOps. Local storage, GUI, full-text search (Pro) and a native n8n node ship with it.	Flat licence per device: Free $0, Pro $99/year or $10/month, extra seats addable. No per-message fee, no Meta approval, unlimited WhatsApp accounts on Pro.	Unofficial automation still carries real risk. SocialMate reduces it with pacing, warming, caps and risk scoring, and does not eliminate it. Bans remain possible.

Frequently asked questions

Is WAHA or Evolution API free to use?

Both are free to license and neither charges per message. WAHA has a free core alongside a paid WAHA Plus tier; Evolution API is open source. The real cost is infrastructure: Evolution API needs PostgreSQL and Redis on top of the application, while WAHA's default is a single container with optional storage. Budget for servers and the hours spent operating them.

Which is easier to self-host, WAHA or Evolution API?

WAHA is the smaller install. Its documented default is one application container with a dashboard, adding a database only when you want durable storage. Evolution API's standard Docker deployment runs the API beside PostgreSQL and Redis, plus a TLS proxy. Fewer services means fewer things to patch, back up and restart in order, which is where most operational time goes.

Do WAHA or Evolution API include anti-ban protection?

No. Neither ships randomised delays and jitter, pacing profiles, per-number rate caps, new-number warming, a typing indicator with read-before-reply, a duplicate-content guard or live risk scoring. They are protocol bridges and never claimed otherwise. You write that layer yourself, typically after a warning or a temporary restriction makes the need obvious.

Does using WAHA or Evolution API violate WhatsApp's terms?

WhatsApp's Business Messaging Policy prohibits unauthorised automation and unsolicited messaging. Both projects drive an unofficial WhatsApp Web session, which sits outside the sanctioned Cloud API route. That is a policy question for you and, if it matters commercially, your counsel. Enforcement, including temporary limits and permanent bans, is WhatsApp's decision to make.

Can I use WAHA or Evolution API with n8n, Chatwoot or an AI agent?

Yes, through their REST APIs and outbound webhooks. You build the flow with n8n's HTTP Request and Webhook nodes, or depend on community packages, and you provide a stable inbound URL through a tunnel or public server. Any agent that can make HTTP calls wires in the same way, with the same glue you maintain.

Can an AI agent use SocialMate without custom glue?

Largely, yes. Install the n8n community node and every operation becomes an AI-Agent tool, or point an MCP client such as Claude Desktop or Cursor at the native socialmate-mcp server, which exposes 44 WhatsApp tools. Both run through the same anti-ban, key-scope and tier checks as the HTTP API, so an agent cannot bypass a limit. AI replies generated by SocialMate are not shipped yet.

Is SocialMate affiliated with WhatsApp or Meta?

No. SocialMate is an independent product and is not affiliated with, endorsed by, or partnered with WhatsApp or Meta, and it is not the official WhatsApp Business API. WhatsApp and Meta are trademarks referenced for identification only. Using any unofficial automation, SocialMate included, remains a policy risk that no vendor can absorb for you.

How many messages per day can I send with SocialMate?

Free allows up to 200 messages a day on one account. Pro starts at a deliberately safe 500 a day per account and, after 72 hours of session warming, High-Volume Mode scales to 5,000 a day per account. WhatsApp accounts are unlimited on Pro. Higher volume is never risk-free, and bans remain possible with any tool.

How much does it cost to run Evolution API for a year?

The licence is free. The bill is infrastructure and labour: a VPS sized for the API, PostgreSQL and Redis with backup headroom, plus the hours spent patching three services and the proxy in front of them. Labour is usually the larger line. Check current host pricing for your region rather than trusting a number in a blog post.