WhatsApp integration (Evolution API)
System > Integrations > WhatsApp (/settings/integrations/whatsapp). With Evolution connected, the Fetch photos tool (in Maintenance) starts trying to pull your contacts' WhatsApp pictures.
What it does — and what it doesn't
This integration doesn't display any picture on its own. It's a source for the photo fetch, not a feature in its own right. Without it, the fetch uses Gravatar only — "and it rarely has a picture for a Brazilian number", which is precisely why the integration exists.
Any picture found is stored on the person's record. It isn't fetched on every visit, nor behind the scenes: only when someone runs Fetch photos.
The picture shows up in People — in the listing and on the detail screen. It does not show up on the payables or receivables screens.
Per-company setup
The credentials are per company, not per workspace — each one can have its own instance. With no company selected, the page doesn't show the setup: it stays on "Select a company".
The company comes from the header selector, not from a step inside the page.
There are three fields, and the button only unlocks with all three filled in:
| Field | Example |
|---|---|
| Evolution API URL | https://evolution.example.com |
| Instance name | kobana-finance |
| API key | The instance's key. "The key is stored encrypted and never returned on GET." |
The button is "Connect" — or "Update", if credentials are already there.
Privacy and security
- The API key is encrypted at rest and is never returned on read.
- The system refuses private destinations: loopback addresses, internal networks and link-local are blocked, which stops the integration being used to reach infrastructure services.
HTTPS isn't mandatory. http:// is accepted — what the system refuses is the destination, not the protocol. Even so, an endpoint on HTTP sends the API key in the clear: prefer HTTPS.
Fetch photos
The fetch is manual, in Maintenance → Fetch photos. There's no periodic worker.
Each run:
- Tries Gravatar first (by email) and WhatsApp second (by phone), stopping at the first source that answers.
- Walks only through people who don't have a picture yet — anyone who already has one is skipped.
- Processes at most 100 people at a time.
- Waits 30 days before retrying anyone who failed.
Removing
The button is "Remove". The confirmation states the exact effect: "The credentials for the company will be deleted. The next 'Fetch Photos' run for this company will skip WhatsApp — Gravatar only."
Pictures already fetched stay on the record: removing the credential doesn't erase what was found.