WhatsApp Flows — the in-chat forms Indian businesses use for lead capture, appointment booking, KYC, and order collection — will now work fully on WhatsApp Web starting early December 2025. Alongside this, Meta has released Data API version 4.0, which strengthens how Flow endpoints verify that requests genuinely come from the intended user. Both changes roll out automatically, with no code changes required to receive them.
What's changing
According to Meta's official WhatsApp Business Platform changelog, "Beginning in early December 2025, we will begin supporting Flows on WhatsApp Web. Users will be able to open, complete, and view Flow responses on WhatsApp Web companions." Previously, Flows rendered reliably only on the mobile WhatsApp app — a gap that affected anyone running WhatsApp on a desktop or laptop.
Meta has confirmed this feature "will be enabled automatically" for businesses already using WhatsApp Flows. There is no opt-in, no new API call, and no configuration step on the business side.
Data API v4.0: stronger Flow endpoint security
In the same changelog update, Meta announced Data API version 4.0, described as featuring "improvements to the security of the Flows endpoints." The key change is in how requests are authenticated. Meta states: "Previously, the system relied on flow tokens as identifiers," and the new version has "strengthened the security of WA Flows endpoints" to better confirm that a request genuinely originates from the intended recipient, rather than relying solely on the token as proof of identity.
This matters because Flow tokens alone are a relatively weak signal — if a token were somehow intercepted or replayed, a system trusting only the token could be tricked into treating a spoofed request as legitimate. Data API v4.0 adds additional verification on top of the token to close that gap.
Why this matters for Indian businesses
WhatsApp Flows have become a default tool for Indian SMEs, NBFCs, insurers, and service businesses that want to collect structured customer data without redirecting users to a website. Common use cases include:
- Loan and KYC data collection for lending and insurance products
- Appointment and service booking forms
- Order forms and product configuration for D2C and retail brands
- Post-service feedback and satisfaction surveys
Until now, agents and back-office staff who run WhatsApp on a laptop — a common setup for support teams and SMEs — couldn't reliably use Flows the way mobile users could. Extending full open, complete, and view support to WhatsApp Web closes that usability gap, meaning desktop-based teams can now handle Flow-based interactions the same way as mobile users, without switching devices.
The security upgrade in Data API v4.0 is arguably the more consequential change for regulated sectors. Banks, NBFCs, and insurers using WhatsApp Flows to collect bank details, ID numbers, or addresses for KYC and service requests operate under RBI oversight, where data handling and authentication practices are scrutinized. A stronger guarantee against spoofed or replayed requests reduces the risk surface for these use cases, even though the underlying customer experience doesn't change.
What businesses and developers should do
Because both changes are automatic, there is no urgent action required to receive them. However, Meta's guidance implies that Indian developers and BSP partners should review their Flow endpoint validation logic to ensure it isn't relying solely on legacy flow-token checks, since Data API v4.0 introduces additional verification the endpoint should be able to handle correctly. Businesses that built custom Flow endpoints in-house, rather than through a BSP-managed integration, are the ones most likely to need a code review.
FAQ
Do I need to do anything to get Flows on WhatsApp Web?
No. Meta says the feature is enabled automatically for businesses already using WhatsApp Flows — there's no developer action or configuration required.
Will this change how my existing Flows behave on mobile?
No. The update extends Flow support to WhatsApp Web; mobile behavior is unaffected.
Does Data API v4.0 replace flow tokens entirely?
Not entirely. Meta describes the change as strengthening security beyond relying on flow tokens as the sole identifier, adding further verification that a request comes from the intended recipient.
Should we update our Flow endpoint code right away?
If your Flow endpoints are self-built, it's worth reviewing your validation logic to confirm compatibility with the v4.0 security model. If you use a BSP-managed Flow setup, check with your provider on whether any changes are needed on their end.
