SMS, WhatsApp & Push Notifications

Paid pluginsize Lplanned, not built

Indicative price, not an offer: $25-49/mo + per-SMS usage tier (0.5-2 cents/SMS); anchor: Postscript $30/mo for starter

Generated from docs/plan/paid/sms-whatsapp-push-notifications/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

A paid module that unifies SMS, WhatsApp, and push notifications in one platform. Requires SMS gateway credentials (Twilio, Brevo) and includes compliance tooling (TCPA, SMS consent, WhatsApp Business API). Includes carrier relationships and support SLA for delivery.

The problem

Email alone doesn’t reach customers; SMS gets 95%+ open rates within 5 minutes but requires carrier relationships and compliance with TCPA and GDPR. WhatsApp and push notifications multiply reach. Merchants need one platform to manage all channels, not separate logins for Postscript, Firebase, and WhatsApp.

What it does

• SMS campaign builder (text-based, URL shortener, preview across carriers)
• WhatsApp message builder (text, images, video, buttons, interactive templates from WhatsApp Business API)
• Push notification builder (title, body, image, deep link to app)
• Unified contact management (one subscriber record with SMS, WhatsApp, push preferences)
• Segmentation across channels (send SMS to opted-in SMS subscribers, push to app users, WhatsApp to WhatsApp-enabled contacts)
• Scheduled sends (one-time, recurring, or trigger-based)
• SMS/WhatsApp/push analytics (delivery rate, open rate, click rate, reply rate for WhatsApp)
• Opt-in and opt-out compliance (TCPA double-opt-in for SMS, WhatsApp Business API consent, Firebase push opt-out)
• Phone number validation and carrier lookup
• Bounce and complaint handling (hard bounce, STOP reply, INVALID_NUMBER)

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• SMS gateway provisioning (Twilio, Brevo, Postscript; merchant must have account) — paid credential seam; core doesn’t manage vendor relationships
• WhatsApp shared inbox (view all customer WhatsApp replies in one dashboard) — requires heavy engineering; separate paid ‘whatsapp-inbox’ module owns this
• MMS (multimedia SMS; distinct from WhatsApp video) — many carriers don’t support; separate paid ‘mms’ module owns MMS
• Telegram, Signal, or other messaging (WhatsApp only) — separate paid modules own other platforms
• Keyword-based routing (‘text PROMO to opt into campaign’) — separate paid ‘sms-keywords’ module owns two-way keyword tracking
• Predictive send time optimization — paid ‘send-time-optimization’ owns ML

Data model

Extension of sms-marketing. New entities: omnichannel.subscribers {id, email (nullable), phoneNumber, whatsappNumber (nullable), countryCode, carrier, deviceTokensForPush[], subscribedToSms, subscribedToWhatsapp, subscribedToPush, smsOptInAt, whatsappOptInAt, pushOptInAt, createdAt}; omnichannel.campaigns {id, name, channels (sms/whatsapp/push), type, recipientSegmentId, messagePerChannel{smsBody, whatsappTemplateId, pushTitle, pushBody, pushImageUrl, pushDeepLink}, scheduledFor, sentAt, status, estCostUsd, costUsd}; omnichannel.analytics {id, campaignId, channel, subscriberId, sent, deliveredAt, openedAt, clickedAt, repliedAt (whatsapp), conversions}; omnichannel.complianceLog {id, subscriberId, channel, action (opted-in/opted-out/complained/bounced), date, consentProof}; whatsapp.templates {id, name, namespace, element_name, language, status (approved/pending/rejected), approvedAt}; whatsapp.incomingMessages {id, campaignId, fromNumber, messageBody, receivedAt}; push.deviceTokens {id, subscriberId, platform (ios/android/web), deviceToken, registeredAt}.

API

• POST /api/omnichannel/campaigns
• GET /api/omnichannel/campaigns
• GET /api/omnichannel/campaigns/{id}
• PATCH /api/omnichannel/campaigns/{id}
• POST /api/omnichannel/campaigns/{id}/send
• POST /api/omnichannel/campaigns/{id}/cost-estimate
• GET /api/omnichannel/campaigns/{id}/analytics
• POST /api/omnichannel/subscribers
• GET /api/omnichannel/subscribers
• PATCH /api/omnichannel/subscribers/{id}
• POST /api/omnichannel/subscribers/bulk-import
• GET /api/omnichannel/subscribers/{id}/compliance
• POST /api/whatsapp/templates
• GET /api/whatsapp/templates
• GET /api/whatsapp/incoming-messages
• POST /api/push/device-tokens
• GET /api/sms-whatsapp-push/credentials
• POST /api/sms-whatsapp-push/compliance-report

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Campaign builder: select channels, write message per channel, schedule, segment, estimate cost. SMS builder: character count preview, carrier rendering preview. WhatsApp template builder: create template with buttons/variables, submit for WhatsApp approval. Push builder: title, body, image, deep link, preview on iOS/Android. Segmentation: send SMS to opted-in, WhatsApp to opted-in, push to app users. Analytics dashboard: per-channel delivery/open/click rates, WhatsApp reply rate. Incoming messages: view WhatsApp replies (notification stream). Compliance report: download TCPA consent logs, WhatsApp opt-in proof, SMS opt-out list. Provider setup: paste SMS/WhatsApp/push credentials, test connections. Device token management: view registered device tokens per subscriber.

The seam — why this is paid

Core owns free email-newsletter-campaigns (subscriber list, segmentation framework). Paid SMS/WhatsApp/push module owns SMS gateway credentials (Twilio, Brevo, Postscript API keys — core doesn’t manage vendor relationships), WhatsApp Business API credential management and template approval coordination (requires WhatsApp Business account; support needed), TCPA and GDPR compliance tooling (double-opt-in, SMS consent proof, audit trail — legal; merchants need support), push notification platform integration (Firebase, OneSignal credentials — requires app integration support), multi-channel orchestration and routing (business logic, merchant support), cost estimation and billing across SMS/WhatsApp/push with different rates (support commitment for cost accuracy).

Paid module owns SMS gateway credential, carrier API, and compliance (TCPA, SMS consent tracking); core does not manage carrier relationships

Dependencies

• email-newsletter-campaigns or sms-marketing (subscriber list, segmentation)
• Orders module (segment by purchase history)
• SMS provider account (Twilio, Brevo, Postscript; merchant must have)
• WhatsApp Business Account and API access (merchant must apply through Meta)
• Firebase (or OneSignal, etc.) for push notifications
• Scheduler (for scheduled sends)
• Audit log (for compliance: consent proof, opt-outs)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• A phone number is validated as E.164 format (e.g., +1-415-555-0100) or rejected with clear error
• A carrier lookup returns correct carrier name (Verizon, AT&T, etc.) for >95% of US numbers tested
• An SMS campaign sends to 1000 opted-in subscribers and shows delivery rate (delivered/sent) ±1%
• An opt-in SMS arrives to customer within 1 second of subscription; contains double-opt-in link
• A customer who replies ‘STOP’ is automatically opted out and no future SMS is sent to that number
• An SMS campaign cost is estimated before send and matches actual cost (Twilio rate * message count) within $0.01 per 100 messages
• A multi-channel campaign sends email to all subscribers, SMS only to opted-in SMS subscribers, push only to app users
• SMS message preview shows character count and carrier-specific rendering
• WhatsApp message template must be approved by WhatsApp before send; template status shows ‘pending’, then ‘approved’ or ‘rejected’
• Push notification shows title, body, image on iOS and Android lock screen; tapping opens deep link

Risks

Carrier blocking: if merchant buys VoIP phone number, SMS delivery may fail; educate on carrier support for VoIP. WhatsApp template approval: if template contains typos or non-business content, WhatsApp rejects it; provide feedback on rejection. TCPA compliance: if double-opt-in email is lost, merchant is liable for TCPA fines; audit trail must be immutable. Multi-channel message consistency: if SMS says ‘Buy now’ and WhatsApp says ‘Learn more’, messaging is confusing. Cost overrun: if segmentation returns 100x expected audience, SMS costs spike; show cost before send and require confirmation. Push token stale: if device token is no longer valid, push fails silently; handle invalid responses and re-register periodically. WhatsApp rate limiting: if merchant sends template too frequently to same subscriber, WhatsApp may throttle. Incoming message flood: if campaign triggers many customer replies, notification stream may be overwhelming; implement pagination and filters.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.