Chat App Message Service:What is Chat App Message Service?

Core capabilities

Message sending process

Sending a message with Chat App Message Service follows this process:

1. Create a channel and connect to your business account.

2. Use the template manager to design and create a message template. (WhatsApp templates require pre-approval from Meta.)

3. Call the unified multi-channel API to send a message request.

4. The API gateway handles identity authentication, request validation, and traffic control.

5. The channel adapter converts the standardized message request into the specific protocol format for each channel.

6. The Message Queue processes sending requests asynchronously. This enables traffic shaping, ensures high availability, and includes a built-in retry mechanism.

7. The service receives and processes status callbacks from each channel, then pushes the final status to your business system as a message receipt through a webhook.

Feature support

Data security

• Data storage: Message content is encrypted both in transit and at rest. By default, it is retained for 30 days for troubleshooting. Personal information, such as user phone numbers, is protected in compliance with GDPR, CCPA, and other applicable regulations.

• Data residency: Data is stored on dedicated Alibaba Cloud servers.

Opt-in management

Before sending marketing messages, you must obtain explicit opt-in from users. This is especially important for WhatsApp, where users must initiate the conversation or explicitly agree to receive messages through a UI element.

Webhook

To ensure that incoming webhook callbacks are from Alibaba Cloud instead of a malicious third party, you must verify the signature of each request.

import hmac
import hashlib


def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
    """
    Verifies a webhook request signature.

    :param payload: The raw body of the webhook request (in bytes).
    :param signature: The value of the X-Signature-256 header in the request.
    :param secret: Your webhook secret key.
    :return: A boolean indicating whether the verification passed.
    """
    if not signature or not signature.startswith('sha256='):
        return False

    expected_hash = hmac.new(
        secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()

    expected_signature = f"sha256={expected_hash}"

    return hmac.compare_digest(expected_signature, signature)