A hosted, remote WhatsApp MCP server on your own number.
One HTTPS URL, OAuth 2.0 sign-in or a bearer API key, and twelve tools for reading, sending and scheduling WhatsApp messages from your own number. Blueticks runs the server and the WhatsApp session, so there is nothing to self-host.
Endpoints
Read from the live server on 10 November 2026. The metadata documents are public; the MCP URL itself needs authentication.
| What | URL |
|---|---|
| MCP server | https://api.blueticks.co/mcp |
| Server manifest (name, 12 tools) | https://api.blueticks.co/mcp/info |
| Protected resource metadata | https://api.blueticks.co/.well-known/oauth-protected-resource |
| Authorization server metadata | https://api.blueticks.co/.well-known/oauth-authorization-server |
| Authorization endpoint | https://api.blueticks.co/mcp/auth |
| Token endpoint | https://api.blueticks.co/mcp/auth/token |
| Registration endpoint | https://api.blueticks.co/mcp/auth/register |
Authentication
OAuth 2.0 (remote connectors)
Authorization-code grant with S256 PKCE, plus refresh tokens. Supported scopes: openid, email, profile, mcp:read and mcp:write. The user signs in to Blueticks and approves access, so no API key is stored in the client.
Bearer API key
For a client that only supports a bearer key, send a Blueticks bt_live_ key in the Authorization header. It is the same server as the OAuth connector, and you see the tools your account has. Create the key under Blueticks API, give it only the scopes you need, and revoke it there at any time.
Authorization: Bearer bt_live_your_key_here
How a client discovers sign-in
An unauthenticated request returns 401 with a WWW-Authenticate header pointing at the protected resource metadata, which names the authorization server. You can reproduce it:
curl -i -X POST https://api.blueticks.co/mcp \
-H 'content-type: application/json' -d '{}'
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="https://api.blueticks.co/mcp",
resource_metadata="https://api.blueticks.co/.well-known/oauth-protected-resource"Tools
Twelve tools on a standard account: chats_read, chats_write, contacts, groups, scheduled_messages_read, scheduled_messages_write, audiences, campaigns, webhooks, tasks, engine and utils. The live list is at api.blueticks.co/mcp/info, and each tool's actions are on the MCP page. Reading and sending are separate tools: sending goes through chats_write, scheduled_messages_write and campaigns, and works only while your WhatsApp is linked and online. Approve each call yourself.
How it connects to WhatsApp
Blueticks operates an unofficial WhatsApp Web automation engine: your number is linked as a device. It is not the Meta Cloud API, and Blueticks is not affiliated with or endorsed by WhatsApp or Meta. We cannot promise a number will never be restricted. If you message other people, consent and opt-out are your responsibility.
Frequently asked questions
What is a remote WhatsApp MCP server?
It is an MCP server you reach over HTTPS instead of running locally. Blueticks hosts it and runs the WhatsApp session, so a client only needs the server URL and a sign-in. There is no bridge or process to run on your machine.
How does a client authenticate?
Two ways to the same server. The remote connector flow uses OAuth 2.0 with the authorization-code grant and S256 PKCE, per the server metadata. Clients that only support a bearer key can send a Blueticks bt_live_ API key in the Authorization header.
How does a client discover the sign-in flow?
An unauthenticated request to the MCP URL returns 401 with a WWW-Authenticate header whose resource_metadata points to the protected resource metadata. That document names the authorization server, whose metadata lists the authorization, token and registration endpoints.
Which scopes and grant types does it support?
The authorization server metadata lists the scopes openid, email, profile, mcp:read and mcp:write, and the grant types authorization_code and refresh_token, with S256 as the only PKCE method.
Which tools does it expose?
Twelve tools on a standard account: chats_read, chats_write, contacts, groups, scheduled_messages_read, scheduled_messages_write, audiences, campaigns, webhooks, tasks, engine and utils. The list is served at /mcp/info.
Does it use my own WhatsApp number?
Yes. You link your number as a WhatsApp Web linked device by QR code or phone-number link code. It is not the Meta Cloud API and not an official Meta product. If no WhatsApp is linked, or the connection is offline, requests fail with a "No WhatsApp is connected" error.
What does it cost?
There is no extra charge for the connector and it works on any Blueticks plan. The free plan allows 5 requests per 6 hours, shared with the API; paid plans have no request limit. See the pricing page for current prices.
Is there a ban risk?
Blueticks connects through the WhatsApp Web linked-device model. We cannot promise that WhatsApp will never restrict a number. Consent and opt-out for anyone you message are your responsibility.
Facts checked on 10 November 2026. More: hosted WhatsApp MCP service, pricing, the best WhatsApp MCP servers, hosted services compared, developer docs.