CodePrism Technologies logoCodePrism Technologies
Case Study — Messaging & Automation

Building a Native WhatsApp Forms Engine on PrismWA

A visual builder and runtime for Meta's WhatsApp Flows - letting teams design multi-screen forms, power them with live data, and collect structured responses without a single Meta dashboard visit.

PlatformWeb & WhatsApp
Duration6 weeks
TypeMessaging & Automation
Stack10 technologies
PROJECT OVERVIEW

14

Drag-and-drop field types

3

Ways to power a screen with live data

0

Duplicate submissions, by design

THE CHALLENGE

WhatsApp messaging gets complicated at scale.

Teams running WhatsApp-based surveys, lead capture, or bookings had two bad options: build a web form and paste a link into the chat (which breaks the point of being "in WhatsApp" and loses a chunk of respondents at the tap-out), or hand-author raw WhatsApp Flow JSON and manage it through Meta's Flow Builder and Graph API directly - a process with no visual preview, a strict component schema, and a public-key encryption protocol that has to be implemented correctly before Meta will even let you publish.

Challenge 1

Sending a plain link instead of a native form loses respondents at the app-switch

Challenge 2

Meta's raw Flow JSON format has no visual editor and fails validation on small mistakes

Challenge 3

Every dynamic screen (a dropdown fed by an API, a personalized message) requires implementing Meta's Data Exchange encryption protocol from scratch

Challenge 4

Republishing a flow for a trivial config change re-triggers Meta's full validation and review pipeline unless you specifically avoid it

Challenge 5

Submitted responses arrive back as a WhatsApp webhook payload, not structured data - someone still has to wire that into a CRM or spreadsheet

Measurable Impact
14Drag-and-drop field types available in the builder (text, choice, date, media, and branching components)
3Independent ways to power a dynamic screen (static, external API + JMESPath, custom function)
2048-bitRSA key size generated per flow for Meta's Data Exchange encryption
0Duplicate submissions, enforced via flow-token dedup on the inbound webhook
WHAT WE LEARNED
01

Meta's Data Exchange protocol is well-documented but unforgiving - get the encryption handshake exactly right or debug blind

02

Hashing the transformed output before republishing avoids needless Meta API calls and keeps config tweaks fast

03

Giving admins a custom-function escape hatch (not just static config) covers the long tail of "one more API" requests without new engineering work each time

04

Server-authored code execution is only safe with an explicit trust boundary - restricting it to trusted roles is a stopgap, not a permanent answer

Technologies Background
Our Technologies

Built with technologies we trust.

NestJS
Next.js (App Router)
Meta WhatsApp Flows / Graph API
PostgreSQL
Prisma
RSA-OAEP + AES-128-GCM (Node crypto)
JMESPath
BullMQ
Redis
TypeScript

Project Goals

Give workspace admins a drag-and-drop builder for native WhatsApp forms - no JSON required
Implement Meta's Data Exchange protocol (RSA + AES-GCM handshake) so screens can carry live data
Support three ways to power a dynamic screen: static options, an external API, or a custom function
Publish flows to Meta with a smart diff, so unchanged flows don't get needlessly resent for review
Capture every submission automatically and forward it to an external system with field mapping

The Outcome

PrismWA now ships a complete native WhatsApp Forms feature: a visual builder, Meta's encrypted Data Exchange handshake, three ways to power live screens, and automatic, de-duplicated submission capture - with no hand-written Flow JSON and no manual data wiring.

Conclusion & Impact

"This project showed that Meta's WhatsApp Flows platform is genuinely capable - multi-screen native forms with conditional logic, live data, and media capture - but the protocol underneath (encrypted data exchange, strict JSON schema, opaque validation errors) is unforgiving to build against directly. Wrapping it in a visual builder and a runtime that owns the crypto handshake turned a protocol only a backend engineer could touch into something any workspace admin can design."

Have a project in mind?

Let's discuss how we can help you build your next big thing.
Reach out and our team will be in touch.

Protected by reCAPTCHA. Google Privacy & Terms apply.

Building systems that hold up in production.

Bring up the problem others won't attempt.