One Next.js app covers the inbox, deals, and automations
wacrm is a concrete WhatsApp CRM that its author expects you to fork. The application includes a shared inbox with assignment and notes, contacts with tags and custom fields, Kanban sales pipelines, broadcasts using approved templates, and a visual automation builder. Team roles range from owner to viewer. The transport is Meta's official WhatsApp Business API, with Supabase providing Postgres, authentication, storage, and row-level security.
The scope goes well beyond a message viewer. A public REST API can read contacts and conversations, send messages, and launch broadcasts. An optional reply assistant calls OpenAI or Anthropic with an account's own key. Its knowledge base uses Postgres text search by default and can add pgvector semantic search when an embeddings key exists.
Fork ownership includes application maintenance
The README repeatedly calls wacrm a template. Its intended path is fork, brand, modify, and host, while feature pull requests may belong in the user's fork. That is honest positioning. You receive source under MIT and can change the fields or workflow, but there is no vendor promising migrations, support, or compatibility for your modifications. A CRM that holds customer conversations needs someone responsible for upgrades and incident response.
The stack is familiar: Next.js 16, React 19, TypeScript, Tailwind 4, and Supabase. The repository's 480 files and roughly 75,193 source lines are already large enough that casual customization can have consequences outside the page being edited.
What happened when we ran it
Our sandbox installed commit 6ed9191 in 23 seconds. Npm added 939 packages and occupied 973 MB on disk, far more than the 4 MB checkout. The build ran for 34 seconds and failed with exit code 1 while prerendering /forgot-password. Supabase's SSR client said a project URL and API key were required, and the Next.js worker stopped.
The test command succeeded in 16 seconds. Vitest reported 825 passed and 0 failed out of 825. Npm audit found 0 known vulnerabilities in the installed dependency tree. Those are reassuring repository signals, especially beside the build failure: the tested logic passed, while the production compilation path assumed configuration that our secret-free sandbox did not have. We did not substitute dummy Supabase values because that could hide a second configuration error.
Our scan found 2 CI workflow files, a Dockerfile, and a Compose file. The build log identifies the missing Supabase URL and API key. It does not show whether valid values are sufficient for a complete build, so a buyer should run that check against a disposable Supabase project before scheduling deployment.
Supabase and Meta configuration start before deployment
Four environment values are required according to the example file: the public Supabase URL, anonymous key, service-role key, and a 64-character hexadecimal encryption key. The Meta app secret is also marked required because inbound webhook requests are checked with HMAC-SHA256.
The service-role credential bypasses row-level security and belongs only in server routes. The encryption value protects saved WhatsApp and AI provider tokens with AES-256-GCM. Rotation has a sharp consequence documented in the template: every token encrypted under the previous value becomes unreadable, so users must save their WhatsApp settings again. Secret backup and rotation procedures should be written before the first team account is invited.
Docker excludes the database, migrations, and scheduler
The included container runs as a non-root user and serves the standalone Next.js output. Compose starts 1 application service; it does not create Supabase. Operators apply the migrations separately and point the app at a hosted or self-hosted project. Public Supabase variables are built into the browser bundle, so changing either one requires rebuilding the image rather than restarting it.
Automation waits also depend on something outside the container. An external scheduler must call 2 cron endpoints with a shared secret, and those endpoints answer 503 until the secret exists. Media storage needs planning too. The Docker guide says received attachments can be copied into a Supabase bucket because Meta later removes them, but files over 16 MB are never copied and the bucket grows with message volume.
MCP writes require scopes and explicit switches
The bundled MCP server works with Claude Code, Claude Desktop, Cursor, and other MCP clients. Its default tools can read contacts, conversations, messages, identity, and broadcast status. Sending a message or changing a contact requires both an API key with the matching scope and WACRM_ENABLE_WRITES=true. Broadcasts add a separate switch and an explicit confirmation parameter.
The REST API has similar care around credentials. Keys are account-scoped, stored as SHA-256 hashes, shown once, and revocable. The standard limit is 120 requests per minute for each key. That limiter lives in memory inside one process, so multiple app instances do not share enforcement. Teams planning horizontal scaling need Redis, Upstash, or another shared counter before they can rely on that limit as a system-wide control.
Outbound webhooks can lose an event after one attempt
API webhooks are signed, require HTTPS, reject private network targets, and can disable an endpoint after repeated failures. Delivery is best-effort with 1 attempt, a short timeout, and no followed redirects. Events may arrive out of order or more than once, so consumers must deduplicate by delivery ID and reconcile through the read API. The docs label a durable retry queue as a future idea and say it is not scheduled.
GitHub recorded the last push on August 27, 2026. The repository had 2,126 stars and 26 combined open issues and pull requests, split into 11 issues and 15 pull requests. Activity on August 27 included fixes and reports concerning sender identity, webhook status details, and Supabase read-only behavior. There is no tagged GitHub release. Pin commit 6ed9191 or another tested revision, and deploy only after the Supabase-backed build succeeds in your own environment.