Functions

Code that runs where your numbers live

Functions run your TypeScript or JavaScript on the Polymorfa server that holds your numbers and hosted messages. No round trip to a server of yours, and message data stays where it is.

Start building Read the Platform API guide

Beside your numbers

No round trip to your server

A Flow step forwarded to your server crosses the internet and waits for the answer. A function answers from the server that already holds the number and its hosted messages.

Forwarded to your server. The request leaves Polymorfa, reaches your HTTPS endpoint and comes back before WhatsApp shows the next screen.

Run as a function. Decrypt, run and reply on one server. Your code gets the request without it crossing the internet.

WhatsApp Flows

Flow endpoints, keys included

WhatsApp encrypts every Flow data exchange. Polymorfa holds the number's key, decrypts each request and never stores what it contains.

A managed data endpoint

Run a function with the request JSON
Or forward it to your HTTPS URL, signed
Or bring your own key, and Polymorfa never decrypts

Keys that rotate safely. A rotation registers a new 2048-bit RSA key with WhatsApp for the number. The previous key keeps decrypting for 24 hours.

Read the Flows guide

Isolation

A fresh sandbox for every run

Each invocation starts a new sandbox with no network of its own. Outbound requests pass through a broker that allows only the HTTPS origins you list.

Nothing shared between runs. Every run gets 256 MB of memory and a read-only file system, and the sandbox ends with it.

Only the origins you allow. Requests reach public HTTPS origins listed on the deployment. IP addresses, custom ports and Polymorfa hosts are refused.

Signed, and run once. The runtime checks the signature on every artifact and invocation, and refuses an invocation it has already run.

Deploy

Deploy, test, then promote

Deployments are immutable and pin their secret versions. Test one, then promote it; calls pinned to an older deployment keep running it.

Immutable deployments. Each deployment keeps its source hash. Promotion checks the revision you last saw, so two people never overwrite each other.

Write-only secrets. Values are encrypted and never shown again. A new version leaves running deployments alone; revoking one stops new runs that use it.

No-code actions. Chain a request, a condition and a response without writing a function. Inputs, secrets and earlier results fill in the values.

Receipts, not payloads. Each run records its trigger, outcome and response size. Requests, responses and log output are not kept.

In your code

A Flow step in twenty lines

Write the handler, deploy it with its secrets and allowed origins, then promote it. The SDK and CLI cover the same operations as the Console.

Read the Platform API guide SDK docs CLI docs

table-availability.ts

import { defineFunction } from "@polymorfa/functions";

export default defineFunction({
  async handler(request, event, ctx) {
    if (ctx.trigger.kind !== "flow") {
      return new Response("Not found", { status: 404 });
    }

    // The Flow data exchange, already decrypted.
    const { data } = await request.json();

    const res = await fetch(`https://api.acme.com/tables?date=${data.date}`, {
      headers: { authorization: `Bearer ${ctx.env.ACME_API_KEY}` },
      signal: ctx.signal,
    });
    const { times } = await res.json();

    return Response.json({ screen: "PICK_TIME", data: { times } });
  },
});

Plans and limits

Invocations included with every number

Allowances reset monthly. Beyond them, invocations cost 100 credits per million.

Monthly Function invocations included per number
Number	Invocations a month
Free	1,000
Standard	250,000
Pro	1,000,000

Limits for each Function run
Limit	Value
Run time	10 s by default, 30 s at most
Response size	1 MiB
Memory	256 MB
Outbound requests	10 per run
Source	256 KiB
Allowed origins	32 per deployment

API surface

The Functions API

Manage Functions, deployments, secrets and invocations through the Platform API. Flow endpoints and keys live beside them.

Read the Platform API guide

Functions

POST/platform/functionsCreate a Function
POST/platform/functions/{functionId}/deploymentsBuild an immutable deployment
PUT/platform/functions/{functionId}/promotionPromote a deployment
POST/platform/functions/{functionId}/secretsAdd a secret version
POST/platform/functions/{functionId}/invocationsRun it with an idempotency key
GET/platform/functions/{functionId}/invocationsRead receipts

WhatsApp Flows

PUT/platform/flows/{flowId}/endpointRun a function, forward or go direct
GET/platform/flows/{flowId}/endpoint/receiptsData endpoint receipts
GET/platform/flow-encryption-keysA number's Flow key custody
POST/platform/flow-encryption-keys/rotateRotate the managed key

Start with a free number

Your first real number is free. Add more numbers on Pay-As-You-Go.

Start building See pricing