A capable WhatsApp integration layer
Evolution API puts a REST interface in front of two very different ways to reach WhatsApp. One uses Baileys, which acts like a linked WhatsApp Web device. The other uses Meta's official Cloud API. Around those channels, the service can send events to webhooks, WebSockets, RabbitMQ, Kafka, NATS, Amazon SQS, or Pusher. It can store media locally or in S3-compatible storage and connect conversations to Chatwoot, Typebot, Dify, Flowise, n8n, and OpenAI.
That range is the reason to consider it. A team building a support workflow may otherwise have to write device-session handling, webhook normalization, media storage, retry plumbing, and a Chatwoot bridge. Evolution API gathers those concerns into instances controlled through one API. It supports PostgreSQL and MySQL through separate Prisma schemas, and its environment file exposes detailed switches for which records and events should be retained.
The two WhatsApp paths should not be treated as interchangeable. The README describes Baileys as a free, unofficial route with limitations compared with official APIs. Meta Cloud API brings Meta policy requirements and messaging costs. For a hobby bot, Baileys may be the appeal. For a business where a missed customer message has a price, the official route is the more defensible starting point, though it still needs monitoring.
What happened when we ran it
We cloned commit fa09d37 into an unprivileged Node 22 container with 3 CPUs and 8 GB of RAM. The repository contained 625 files, about 53,414 lines of source, and occupied 4.2 MB before dependencies. npm install succeeded in 27 seconds, installing 1,274 packages and taking 731 MB on disk. The repository includes five CI workflow files and a Dockerfile, but no tests directory.
The build failed with exit 2 after 13 seconds. Its final errors were TypeScript errors against the generated Prisma client. Source files imported Contact, Message, and Proxy, while the client did not export them. Other errors said ContactFindManyArgs and Prisma.sql were unavailable. That is as far as the log takes us; it does not establish why the generated client and source disagreed.
The test command timed out after 900 seconds. The log ended with ERR_MODULE_NOT_FOUND for test/all.test.ts, the file named by the package's test script. npm audit found 88 known vulnerabilities, split across 3 critical, 30 high, 53 moderate, and 2 low. This result makes a source checkout at that commit unsuitable for a copy-paste production deployment.
The setup extends well past npm install
The README's source path starts with Node 20 or newer, npm, an environment file, and PostgreSQL or MySQL. You must choose the database provider before generating the Prisma client and deploying the matching migrations. Redis is recommended for caching. An API key protects the HTTP interface, while each WhatsApp instance has its own connection authentication.
After that, effort depends on which parts you enable. Meta Cloud API needs its webhook verification token, Graph API settings, and business credentials. Baileys needs a phone to link a device and persistent session state. SQS, Kafka, RabbitMQ, Pusher, S3, MinIO, OpenAI transcription, Chatwoot, and Typebot each introduce another credential or endpoint. The supplied Docker image is the shortest evaluation path, but it does not remove database migrations or provider configuration.
Telemetry is enabled through an environment setting. The README says it collects route use, frequently accessed routes, and the API version without personal or sensitive data. Operators with a strict outbound-data policy should disable it explicitly and verify the deployed environment rather than relying on an assumed default.
Delivery correctness needs its own safety net
Current issue activity contains problems that matter more than cosmetic defects. One detailed Baileys report says some inbound messages appeared in the phone and even in Evolution logs, yet no MESSAGES_UPSERT webhook reached n8n. The reporter also saw an instance become undeletable until the container restarted. This is one report, not proof that every deployment loses messages, but it describes exactly the failure a messaging bridge must detect.
A separate Meta Cloud API report says delivery callbacks containing a contact without a profile triggered a property-access error. According to that report, the exception occurred before the code emitted MESSAGES_UPDATE, so sent, delivered, and read states were lost. Another open report says a generated pairing code was rejected by WhatsApp and left the Baileys instance connecting. These are good reasons to reconcile outgoing message IDs, alert on stalled instances, and keep upstream webhook logs outside Evolution API.
Baileys also carries account-policy exposure. A recently updated issue describes device_removed disconnects and a 24-hour restriction. The project itself labels this connection method unofficial. No wrapper can turn a web-client session into the same contractual service as Meta's business platform.
Health, licensing, and the decision
The repository was last pushed on July 14, 2026. Issues and pull requests were still being updated in August, including fixes around newer WhatsApp identifier behavior, so the project is active despite its latest stable release dating to December 5, 2025. GitHub reports 203 open issues and pull requests combined. That is a busy queue, and the recent delivery reports deserve more attention than the star count.
Licensing also needs a real review. The README calls the project Apache 2.0 with extra brand-protection terms. The license says frontend branding must remain and any project using Evolution API must show an administrator-visible usage notice; it also says failure to meet those conditions may require a commercial license. That is more restrictive than stock Apache 2.0 expectations, so a product team should have counsel read the actual text.
Evolution API can save months of integration work when you truly need several of its channels and event sinks. The measured commit did not clear a basic build and test pass, however, and message delivery is too important to treat open failure reports as ordinary backlog. Trial it behind reconciliation and alerts, pin every deployed image, and prefer Meta Cloud API when the connection is part of a paid customer operation.