One inbox per client.
On your own server.
Unreadbox is a multi-tenant CRM for the official WhatsApp Business Cloud API. Agencies run it for their clients, SaaS operators resell workspaces — no message relay, no monthly platform fee, no data leaving your infrastructure.
PHP 8.2+ · MySQL or SQLite · Installs in ~20 minutes · One-time license
The parts other scripts get wrong
Message delivery is the easy half. Tenant isolation, quota control and the 24-hour rule are where self-hosted CRM builds usually break.
Fail-closed tenancy
Every query is scoped to the current tenant. No tenant context means zero rows — never the whole table. Client data cannot leak, even by accident.
24-hour window enforced
Free-form replies are only sent inside Meta's 24-hour service window. Outside it, the system refuses with a clear error instead of a silent API failure.
Quota gates per tenant
Monthly message quota with atomic pre-deduction, a soft cap at 110% and a hard block beyond it. Integer math — no float rounding drift.
Credentials encrypted at rest
Cloud API tokens are sealed with AES-256-GCM. What you see afterwards is a fingerprint, never the token itself.
Webhooks done properly
Signature verification, raw payload archived before processing, deduplicated by message ID, status chain that only moves forward.
Mock driver included
Build, demo and test the entire flow with META_DRIVER=mock — no Meta account needed. Flip one env var to go live.
Twenty minutes, four steps
No Docker required, no external services. A clean VPS and a domain are enough.
- composer install — dependencies
- php artisan migrate --seed — schema + demo data
- Settings → WhatsApp Accounts — paste Cloud API credentials
- Meta webhook — point to /webhook/wa/{tenant}
Upload the package, set .env, run migrations. SQLite works for a demo, MySQL for production.
Each client gets its own tenant: its own number, its own inbox, its own quota.
Paste Phone Number ID, WABA ID and a permanent System User token. They're encrypted on save.
Subscribe the webhook, message the number from a phone, watch it land in the inbox.
Your clients' messages stay your clients' messages
Hosted WhatsApp CRMs charge per seat and keep the conversation history on their servers. Unreadbox runs where you put it — and the license is yours forever.
No message relay, no proprietary gateway, no grey-protocol ban risk. Only Meta's official Cloud API — which is why it's safe to build a business on.
What's in the package
- Full Laravel + React source, unencrypted
- Installation & user documentation
- Feature test suite (tenancy, quotas, webhooks)
- Demo seeder with sample conversations
- System self-check page for go-live
- Free updates & support via item comments
Buy once. Run it forever.
Regular license covers one end product. Extended license for resale-as-a-service.
- Unlimited client workspaces on your server
- Lifetime source access & updates
- Documentation + support in item comments
Or try the demo first: demo.unreadbox.com