10xstation Messaging API: client integration

How a client system (first: Minhaj Kids) receives Messenger and Instagram messages from 10xstation and sends replies back. 10xstation holds the Meta connection; your system never talks to Meta directly.

Credentials

Everything is in your 10xstation account at https://app.10xstation.com/app/developers:

Set your Forwarding webhook URL on the same page, e.g. https://minhaj.kids/api/integrations/10xstation/webhook, then use Send signed test event to check your endpoint.

If the secret leaks, rotate it. The old secret stops working immediately in both directions.

Forwarding and sending require an active plan (trial, paid, or within 7 days of a failed payment). While billing is inactive, inbound messages are still stored and are forwarded once billing is active again.

1. Receiving events (10xstation → you)

For every inbound customer message on a connected Facebook Page (Messenger), its linked Instagram professional account, or a connected WhatsApp number, 10xstation sends:

POST <your forwarding URL>
Content-Type: application/json
User-Agent: 10xstation-Webhooks/1.0
X-10xstation-Event-Id: evt_wz3lEvqO5g0vwJ0P
X-10xstation-Timestamp: 1789648798            (unix seconds)
X-10xstation-Signature: sha256=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>

Payload

{
  "id": "evt_wz3lEvqO5g0vwJ0P",
  "type": "message.received",
  "clientId": "1",
  "channel": "messenger",
  "direction": "inbound",
  "pageId": "1111111111",
  "igAccountId": null,
  "senderId": "25123456789012345",
  "senderName": "Aisha Rahman",
  "messageId": "msg_6VUXwf1xiDy8xcs8",
  "mid": "m_AbC…",
  "text": "Assalamu alaikum, is there space in the Saturday class?",
  "attachments": [],
  "postback": null,
  "timestamp": "2026-09-17T12:39:57.857Z",
  "raw": { "sender": { "id": "…" }, "recipient": { "id": "…" }, "timestamp": 1789648797857, "message": { "mid": "…", "text": "…" } }
}

Replies sent from Meta Business Suite and messages you send through the API are not forwarded back to you.

WhatsApp events

WhatsApp events add these fields:

{
  "type": "message.received",
  "channel": "whatsapp",
  "direction": "inbound",
  "pageId": null,
  "whatsapp": { "phoneNumberId": "109876543210987", "wabaId": "102030405060708", "displayPhoneNumber": "447700900000" },
  "senderId": "BSUID_2f1c…",
  "senderPhone": "447911123456",
  "senderUsername": null,
  "senderName": "Aisha Rahman",
  "kind": "image",
  "text": "Her certificate",
  "attachments": [
    { "type": "image", "url": null, "mediaId": "904050607", "mediaUrl": "https://app.10xstation.com/api/v1/media/904050607", "mimeType": "image/jpeg", "filename": null }
  ]
}

Extra WhatsApp event types:

Downloading WhatsApp media

GET https://app.10xstation.com/api/v1/media/<mediaId>
X-10xstation-Key: <API key>
X-10xstation-Timestamp: <unix seconds>
X-10xstation-Signature: sha256=<hex HMAC-SHA256(secret, "<timestamp>.")>

The signature covers an empty body, so the signed string ends with the dot. The response is the file itself with its Content-Type. 10xstation doesn't store media: it is fetched from Meta when you ask, and WhatsApp deletes it after about 30 days, so download anything you need to keep.

Verifying (required)

Verify against the raw body before parsing JSON, reject anything older than 5 minutes, and use a constant-time comparison.

// Next.js route handler: app/api/integrations/10xstation/webhook/route.js
import { createHmac, timingSafeEqual } from 'node:crypto';

export async function POST(request) {
  const raw = await request.text();
  const timestamp = request.headers.get('x-10xstation-timestamp');
  const signature = request.headers.get('x-10xstation-signature') ?? '';

  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return new Response('stale', { status: 401 });
  }
  const expected = 'sha256=' + createHmac('sha256', process.env.TENX_API_SECRET)
    .update(`${timestamp}.${raw}`)
    .digest('hex');
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !timingSafeEqual(a, b)) {
    return new Response('bad signature', { status: 401 });
  }

  const event = JSON.parse(raw);
  if (event.type !== 'message.received') return new Response('ignored', { status: 200 });

  // Idempotency: 10xstation may deliver the same event more than once.
  // Store event.id (or event.mid) with a unique constraint and skip duplicates.
  await saveInboundMessage(event); // map channel → conversation channel, senderId → contact key
  return new Response('ok', { status: 200 });
}

Delivery rules

• Respond 2xx within 10 seconds. Do slow work after acknowledging.
• Any other status, a redirect, a timeout or a network error counts as a failure. Retries happen after 30s, 2m, 10m, 30m, 1h, 3h, 6h and 12h, then the event is marked failed and 10xstation staff can replay it.
• Delivery is at least once, so deduplicate on id. Order is not guaranteed; sort by timestamp.

2. Sending messages (you → 10xstation → Meta)

POST https://app.10xstation.com/api/v1/messages
Content-Type: application/json
X-10xstation-Key: <API key>
X-10xstation-Timestamp: <unix seconds>
X-10xstation-Signature: sha256=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>
Idempotency-Key: <optional, up to 200 chars, e.g. your outbound message UUID>

Body:

{ "channel": "messenger", "recipientId": "25123456789012345", "text": "Wa alaykum assalam! Yes, two places left." }

Send exactly one of text, attachment or template.

WhatsApp template example — this both re-opens a conversation after 24 hours and starts a new one:

{
  "channel": "whatsapp",
  "recipientId": "447911123456",
  "template": {
    "name": "class_reminder",
    "language": { "code": "en_US" },
    "components": [
      { "type": "body", "parameters": [{ "type": "text", "text": "Aisha" }, { "type": "text", "text": "Saturday 10am" }] }
    ]
  }
}

Templates are created and approved in the 10xstation account under Templates (or in Meta's WhatsApp Manager). components is optional when the template has no variables.

import { createHmac, randomUUID } from 'node:crypto';

export async function sendVia10xstation({ channel, recipientId, text }) {
  const body = JSON.stringify({ channel, recipientId, text });
  const timestamp = Math.floor(Date.now() / 1000);
  const signature = 'sha256=' + createHmac('sha256', process.env.TENX_API_SECRET)
    .update(`${timestamp}.${body}`)
    .digest('hex');

  const res = await fetch('https://app.10xstation.com/api/v1/messages', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-10xstation-Key': process.env.TENX_API_KEY,
      'X-10xstation-Timestamp': String(timestamp),
      'X-10xstation-Signature': signature,
      'Idempotency-Key': randomUUID(),
    },
    body, // must be the exact string that was signed
  });
  const json = await res.json();
  if (!res.ok) throw Object.assign(new Error(json.error.message), { code: json.error.code, status: res.status });
  return json;
}

Success

201 Created (or 200 OK when an Idempotency-Key replays an earlier successful send):

{ "id": "msg_Q1w2E3r4T5y6U7i8", "mid": "m_…", "conversationId": 42, "channel": "messenger", "recipientId": "25123456789012345", "sentAt": "2026-09-17T12:41:02.114Z", "replayed": false }

Errors

{ "error": { "code": "…", "message": "…", "metaCode": 190 } } (metaCode only when Meta returned an error).

3. Messaging window rules (Meta policy)

Messenger and Instagram

• Standard window: you may reply for 24 hours after the customer's most recent message. Each new customer message restarts it.
• After 24 hours: only the HUMAN_AGENT tag allows a reply, up to 7 days after the customer's last message. It is for a human replying manually to a request that couldn't be answered in 24 hours, never for automation or promotions, and requires Meta approval for the 10xstation app. Until approved, the API returns human_agent_not_approved.
• You can never start a conversation. The customer must message first (conversation_not_found).
• 10xstation enforces these rules before calling Meta, so a refused send costs you nothing.

WhatsApp

• Customer service window: free-form text and media are allowed for 24 hours after the customer's last message. Each new message restarts it.
• After 24 hours, or to start a conversation: only an approved template. Meta must approve each template (usually within minutes), and you must have the person's opt-in to receive WhatsApp messages from the business.
• Meta charges for WhatsApp messages directly, under its own per-message pricing, to the card the business adds in WhatsApp Manager. It is separate from the 10xstation subscription.
• Coexistence numbers (also used in the WhatsApp Business app) are limited by WhatsApp to 20 messages per second, and don't support group chats, broadcast lists, or disappearing and view-once messages.

4. Connecting, reconnecting, disconnecting

• Connect: a workspace owner clicks Connect Facebook & Instagram under Connections in the 10xstation account (or opens a single-use link from 10xstation, valid 7 days). Sign in with a Facebook account that administers the Page, share your business and Page, and choose the Page. The linked Instagram professional account is picked up automatically. Your plan sets how many Pages you can connect. For Instagram, also turn on Allow access to messages (Instagram app → Settings → Messages and story replies → Message controls → Connected tools).
• Reconnect: when sends return reconnect_needed, click Connect again and choose the same Page. History and IDs are kept, and it doesn't use an extra Page from your plan.
• Disconnect: click Disconnect under Connections, or remove the 10xstation app in Facebook Settings → Business Integrations (Meta Business Suite → Settings → Integrations). 10xstation unsubscribes from the Page and deletes its tokens.
• WhatsApp: under Connections choose Use my WhatsApp Business app number (coexistence — the app on the phone keeps working, and contacts and up to 90 days of chats are imported) or Connect a new number. A WhatsApp number counts as one channel on your plan, like a Page. Disconnecting deletes 10xstation' token, the synced contacts and the template mirror; the number itself and its WhatsApp history stay with the business.

5. Data held by 10xstation

Messages are kept by 10xstation for 90 days, then deleted. Media files are never stored — they are fetched from Meta on request. Your system is the long-term record. See https://app.10xstation.com/privacy.

Mapping suggestions for Minhaj

Minhaj's WhatsApp moves to 10xstation through coexistence: the existing number keeps working in the WhatsApp Business app, and 10xstation forwards its messages with channel: "whatsapp" alongside Messenger and Instagram.