> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools in WhatsApp conversations

> Prepare narrowly scoped actions for a future WhatsApp channel without confusing sender identity, tool access, and confirmation.

Prepare one useful action, such as looking up an order's delivery status. Keep customer identity checks and business authorization in the service that owns the order.

<Note>
  Threetone can store tool definitions and agent references. A working WhatsApp conversation cannot execute them today. Account assignment, enabled messaging, and saved approval intent do not prove runtime enforcement.
</Note>

## Prepare an order-status action

You need a documented order service, a permitted test account, a workspace member allowed to manage tools, and an explicit rule for verifying the customer.

<Steps>
  <Step title="Define the minimum lookup" id="whatsapp-tools-lookup">
    Return only the status and delivery information needed for the request. Do not return payment details or another customer's address. The service should resolve the authorized customer independently of the agent's generated arguments.
  </Step>

  <Step title="Keep channel identity separate from access" id="whatsapp-tools-identity">
    Plan how your application verifies the relationship between a WhatsApp sender and a customer account. Meta's [message-object reference](https://www.postman.com/meta/whatsapp-business-platform/folder/1dtuocp/messages-object) describes incoming message data; receiving a sender identifier does not grant permission to read private orders. Do not use an unverified phone-number match as the entire access check.
  </Step>

  <Step title="Save and review the tool contract" id="whatsapp-tools-authoring">
    Follow [tool configuration](/agents-platform/configure/tools/overview) and use supported [credentials](/agents-platform/configure/authentication/auth-connections). Keep secrets out of chat messages and prompts. Review the saved tool and intended agent references through the eligible draft or version workflow.
  </Step>

  <Step title="Define failure and confirmation behavior" id="whatsapp-tools-confirmation">
    A failed lookup should report unavailable information without revealing whether another customer's order exists. Any later cancellation or address change needs a separate action that confirms the exact order and proposed change. Preserve action identifiers and reconcile uncertain results before retrying.
  </Step>
</Steps>

Your review should contain permitted inputs, a minimal result, denied-access behavior, and duplicate-request handling. It remains a configuration review until the [channel runtime](/agents-platform/deploy/whatsapp/messaging-and-calls) is released.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I put an order-service API key into a dynamic variable?" id="faq-whatsapp-tools-secrets">Do not put credentials into message text, prompts, or ordinary variable values. Use supported credential references in the applicable tool fields.</Accordion>
  <Accordion title="Can a saved approval policy replace a confirmation step?" id="faq-whatsapp-tools-approval">No. The service performing the action must enforce authorization and the required confirmation. Stored policy alone does not demonstrate that behavior.</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.