What is WA-AKG?

WA-AKG is a self-hosted WhatsApp gateway and dashboard that turns WhatsApp into a programmable REST API. Built with Next.js 16, React, TypeScript, Prisma, and the Baileys library, it provides a web dashboard for managing multiple WhatsApp sessions simultaneously via QR code pairing. Key capabilities include multi-session management, message scheduling with media support, safe broadcast with anti-ban delays, keyword-based auto-replies with context awareness, granular whitelist/blacklist access control, enterprise webhooks for real-time event forwarding, contact management with LID support, a built-in sticker maker with remove.bg integration, and a Swagger-documented REST API with over 109 endpoints. The dashboard supports English, Indonesian, and Brazilian Portuguese. It runs on Node.js 20+ with MySQL or PostgreSQL, and can be deployed via PM2 (recommended), Docker Compose, or bare-metal. Authentication uses API keys and JWT with role-based access control (SUPERADMIN, STAFF, USER). The project is licensed under MIT.

Should you self-host WA-AKG?

WA-AKG scores 56/100 on selfhost.directory (how scoring works) and ranks #30 of 110 in Chat. It has 798 GitHub stars.

It shipped 7 stable releases in the past year. The latest, v1.7.0, came out on 19 October 2026. New versions land roughly every 3 weeks.

Setup is moderate: expect some configuration beyond a single command. It is MIT-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is Zulip (82/100, 26 125 stars). It scores higher overall, so compare the two before you pick. See WA-AKG vs Zulip side by side.

Features

Access control
Auto-reply
Broadcast messaging
Contact Management
Message scheduling
Multi-language UI
Multi-session management
N8n integration
REST API
Role-based Access Control
Sticker maker

How to configure WA-AKG

ADMIN_EMAILEmail of the default SuperAdmin generated on first boot.
Email of the default SuperAdmin generated on first boot.
ADMIN_PASSWORDPassword of the default SuperAdmin generated on first boot.
Password of the default SuperAdmin generated on first boot.
APP_NAMEWA-AKGCustom name displayed across the login screens, dashboard header, and sidebar footer.
Custom name displayed across the login screens, dashboard header, and sidebar footer.
values: string
AUTH_SECRETSecure cryptographic key used for JWT session encryption. Server will exit on startup if this is empty in production! (Generate with `openssl rand -base64 32`).
Secure cryptographic key used for JWT session encryption. Server will exit on startup if this is empty in production! (Generate with `openssl rand -base64 32`).
values: string
AUTH_TRUST_HOSTtrueSet to `true` if your application is deployed behind a reverse proxy (e.g. Nginx, Cloudflare, Apache).
Set to `true` if your application is deployed behind a reverse proxy (e.g. Nginx, Cloudflare, Apache).
values: boolean
BAILEYS_LOG_LEVELerrorVerbosity of WhatsApp socket logging. Options: `trace` \| `debug` \| `info` \| `warn` \| `error` \| `fatal`. Recommend `error` in production to reduce log clutter.
Verbosity of WhatsApp socket logging. Options: `trace` \| `debug` \| `info` \| `warn` \| `error` \| `fatal`. Recommend `error` in production to reduce log clutter.
values: string
BASE_URLhttp://localhost:3000The unified public URL where your application is hosted. Essential for correct authentication callbacks and URL generation.
The unified public URL where your application is hosted. Essential for correct authentication callbacks and URL generation.
values: string
DATABASE_URLThe database connection string (e.g. `mysql://user:pass@localhost:3306/db` or `postgresql://user:pass@localhost:5432/db?schema=public`).
The database connection string (e.g. `mysql://user:pass@localhost:3306/db` or `postgresql://user:pass@localhost:5432/db?schema=public`).
values: string
DEFAULT_LANGUAGEenDefault dashboard UI language (`en`, `id`, `pt-BR`) for users who haven't picked one with the language switcher. See I18N.md.
Default dashboard UI language (`en`, `id`, `pt-BR`) for users who haven't picked one with the language switcher. See I18N.md.
values: string
ENABLE_AUTO_UPDATE_CHECKtruePeriodically query releases repository to check for updates.
Periodically query releases repository to check for updates.
values: boolean
ENABLE_EXPERIMENTAL_FEATURESfalseToggle experimental features.
Toggle experimental features.
values: boolean
ENABLE_NOTIFICATIONStrueSet to `false` to silence UI-based system alerts.
Set to `false` to silence UI-based system alerts.
values: boolean
ENABLE_RATE_LIMITINGtrueProtect API endpoints from brute-force/abuse via rate limits.
Protect API endpoints from brute-force/abuse via rate limits.
values: boolean
ENABLE_TELEMETRYtrueAnonymous Telemetry Heartbeat (true | false) Sends periodic deployment ping to monitoring server for project usage statistics. Set to "false" to completely disable outbound telemetry in sensitive/air-gapped networks.
Anonymous Telemetry Heartbeat (true | false) Sends periodic deployment ping to monitoring server for project usage statistics. Set to "false" to completely disable outbound telemetry in sensitive/air-gapped networks.
ENCRYPTION_KEYWhatsApp Auth State Encryption Key (Optional, 64-char hex string) If omitted, a key is automatically derived from AUTH_SECRET using SHA-256.
WhatsApp Auth State Encryption Key (Optional, 64-char hex string) If omitted, a key is automatically derived from AUTH_SECRET using SHA-256.
FAVICON_URLCustom image URL for the browser tab favicon (leave empty to use default asset).
Custom image URL for the browser tab favicon (leave empty to use default asset).
values: string
HOSTNAMElocalhostServer hostname binding IP or address.
Server hostname binding IP or address.
values: string
LOCALEid-IDPreferred locale for formatting dates and numbers.
Preferred locale for formatting dates and numbers.
values: string
LOGO_URLCustom image URL for your brand logo (leave empty to use default asset).
Custom image URL for your brand logo (leave empty to use default asset).
values: string
MAX_UPLOAD_SIZE_MB50Maximum allowed file upload size (in MB) for media attachments.
Maximum allowed file upload size (in MB) for media attachments.
values: number
MEDIA_STORAGE_PATHuploadsDirectory folder (relative to project root) where downloaded media attachments are stored.
Directory folder (relative to project root) where downloaded media attachments are stored.
values: string
MYSQL_DATABASEwa_akgTarget schema database name.
Target schema database name.
MYSQL_ROOT_PASSWORDRoot access password for the MySQL container.
Root access password for the MySQL container.
NEXTAUTH_URL${BASE_URL}The URL pointing to the NextAuth authentication handler. Should match `BASE_URL`.
The URL pointing to the NextAuth authentication handler. Should match `BASE_URL`.
values: string
NEXT_PUBLIC_ALLOW_INDEXINGfalseSet to `true` to allow search engines to crawl public paths (useful for landing pages).
Set to `true` to allow search engines to crawl public paths (useful for landing pages).
values: boolean
NEXT_PUBLIC_API_URL${BASE_URL}/apiPublic facing API endpoint URL.
Public facing API endpoint URL.
values: string
NEXT_PUBLIC_APP_URL${BASE_URL}Public facing client URL.
Public facing client URL.
values: string
NEXT_PUBLIC_CHAT_PAGE_SIZE50Default number of conversations loaded per page in the chat window.
Default number of conversations loaded per page in the chat window.
values: number
NEXT_PUBLIC_GA_IDGoogle Analytics tracking ID.
Google Analytics tracking ID.
values: string
NEXT_PUBLIC_SWAGGER_ENABLEDtrueToggle public access to the interactive API documentation at `/docs`.
Toggle public access to the interactive API documentation at `/docs`.
values: boolean
NEXT_PUBLIC_SWAGGER_PASSWORDadmin123Basic auth password. Wajib diubah di server production!
Basic auth password. Wajib diubah di server production!
values: string
NEXT_PUBLIC_SWAGGER_USERNAMEadminBasic auth username required to view the `/docs` page.
Basic auth username required to view the `/docs` page.
values: string
NODE_ENVdevelopmentEnvironment mode (`development` \| `production` \| `test`).
Environment mode (`development` \| `production` \| `test`).
values: string
PORT3000The port on which the server will listen. Ensure this port is free on your server!
The port on which the server will listen. Ensure this port is free on your server!
values: string
RATE_LIMIT_PER_MINUTE60Max requests allowed per minute per IP address.
Max requests allowed per minute per IP address.
values: number
REMOVE_BG_API_KEYAPI key from remove.bg for automatic sticker background removal.
API key from remove.bg for automatic sticker background removal.
values: string
SESSION_TIMEOUT_HOURS24Hours after which user authentication sessions expire.
Hours after which user authentication sessions expire.
values: number
TZAsia/JakartaTimezone database string (e.g. `Asia/Jakarta`, `UTC`) for cron campaigns.
Timezone database string (e.g. `Asia/Jakarta`, `UTC`) for cron campaigns.
values: string