A narrower Evolution service with a clearer shape
Evolution Go turns a linked WhatsApp account into an HTTP service. It can create and remove instances, display pairing codes, send text and media, expose status, and publish events through webhooks, WebSockets, RabbitMQ, or NATS. Media can go to MinIO or S3-compatible storage, while PostgreSQL stores authentication and optional message data. Swagger ships with the service for endpoint exploration.
The protocol choice sets the risk boundary. Whatsmeow links as a WhatsApp client; it is not Meta's contracted business API. Changes in WhatsApp's web protocol and accepted message formats can break an endpoint even when Evolution Go's HTTP layer is healthy. A business should decide whether that trade is acceptable before building workflows around the convenient REST surface.
What happened when we ran it
We cloned commit 9337afc into an unprivileged golang:1.24-bookworm container with 3 CPUs and 8 GB of RAM. The checkout had 134 files, about 35,533 lines of source, and occupied 67.6 MB. Dependency installation succeeded in 83 seconds with 139 packages installed.
The build succeeded in 188 seconds. Tests completed in 63 seconds, with go test reporting 8 passed and 0 failed of 8. The repository has one CI workflow file and a Dockerfile. It has no dedicated tests directory, but the Go test run proves that test files elsewhere in the packages executed. Among these four reviews, Evolution Go is the only project whose measured install, build, and tests all completed successfully.
Those results cover code at the pinned commit without secrets or connected services. They do not test WhatsApp pairing, license activation, PostgreSQL behavior under reconnects, event delivery, or media storage. Passing them is a meaningful baseline, especially beside its sibling's failed build, but it is not a live messaging acceptance test.
Setup includes an activation service
The README recommends Docker, while local development uses Make targets for dependency setup, Swagger generation, build, tests, race checks, and database migrations. The sample environment expects separate PostgreSQL URLs for authentication and users, plus a global API key. The current go.mod requests Go 1.25 even though the README says Go 1.24 or newer, so contributors should use the module's requirement.
Evolution Go will not serve its normal API immediately after the process starts. The README says endpoints return 503 until the operator opens the manager, supplies the API URL and global key, and completes license registration. Activation state lives in the runtime_configs database table, and periodic heartbeats maintain it. Release 0.7.2 added headless activation by operator email, but the email must already have completed a first manual registration. This dependency makes fully offline use a poor fit.
RabbitMQ and NATS carry events, MinIO stores media, and a proxy can route the WhatsApp connection. Telemetry sends anonymous route-use and API-version data according to the README.
Pairing is more involved than scanning a QR
Normal linking can use a QR code or phone pairing code. Release 0.7.2 fixed a phone-pairing handler that returned HTTP 200 with an empty code after swallowing an error. It now starts the instance, waits for the websocket, and returns the real failure. The release also moved from a private whatsmeow fork to the upstream library.
Some WhatsApp accounts require WebAuthn passkey confirmation. Evolution Go exposes a short-lived ceremony, and its browser extension performs the assertion on web.whatsapp.com. The operator must configure PASSKEY_PUBLIC_URL so the browser can reach the service. There is no headless bypass; the account owner confirms with a real authenticator.
An open report says 1Password did not appear when the original extension called WebAuthn from a content script. The reporter tested a split design using the page's main JavaScript world for authentication and the extension service worker for API calls. Passkey users should test their browser and password manager combination before an incident forces relinking.
Current issues touch production behavior
The most serious report is a PostgreSQL connection pool leak on commit 9337afc, the same commit we measured. The report says StartClient created a new whatsmeow SQL store on every start or reconnect and did not close the previous pool. Repeated instance or QR cycles eventually exhausted database connections in the reporter's production environment. Several pull requests propose reusing a shared pool, but operators should verify which fix is merged into the image they pin.
Another issue says POST /user/profileName on the latest image never returned, while related profile endpoints did respond. Downstream clients need deadlines on every call, regardless of how ordinary the operation seems. A separate 0.7.2 report found /send/list and /send/button returning a WhatsApp 405 because they used legacy message structures; text, poll, and carousel calls worked in the same session. Endpoint presence in Swagger is not proof that WhatsApp still accepts its wire format.
Health, terms, and the choice
Version 0.7.2 and the last repository push both landed on July 3, 2026. Issues and pull requests remained active through August 24, including pool-leak fixes, shared-state locking, archive-event panic handling, and phone-number resolution. GitHub lists 102 open issues and pull requests combined. The work is active, though much of it has not yet reached a newer stable release.
The repository describes its license as Apache 2.0 with extra conditions. Its text requires an administrator-visible Evolution Go usage notice and preservation of branding in frontend components. It says failure to comply may require a commercial license. Product teams should review those additions instead of assuming ordinary Apache terms from the badge.
Evolution Go is a credible option for a monitored WhatsApp Web integration, and the clean lab result earns it a trial. Pin the exact image, cap and observe PostgreSQL connections, apply client timeouts, and run delivery tests for every message type you plan to expose. If external activation or unofficial protocol risk is unacceptable, it is the wrong foundation despite the tidy Go build.