Integrate HookMyApp

HookMyApp is a passthrough for WhatsApp and Instagram: the user keeps their own Meta token inside HookMyApp, HookMyApp forwards inbound messages to their code, and their replies go straight through Meta (it is not a BSP middleman). Outbound sends route through the HookMyApp gateway (https://gateway.hookmyapp.com/meta/...): the user's app carries a minted hmat_ gateway access token, the gateway swaps it for the underlying Meta token server-side, and the path after /meta is verbatim Meta Graph API. This skill teaches AI coding agents how to drive the @gethookmyapp/cli to integrate a user's app with either a sandbox account (for dev and testing) or the user's own WhatsApp number / Instagram account (connected via Meta embedded signup). The CLI owns credential issuance, tunnel lifecycle, and webhook configuration. Your code never needs to call the HookMyApp API directly.

Direct Meta access still works. Integrations that already call https://graph.facebook.com with their own Meta token are unaffected. The gateway with a minted hmat_ access token is the recommended path for new setups: the access token is scoped to one channel and revocable, and the Meta token never leaves HookMyApp.

Agent Guidance

Key Principles

• The CLI is the source of truth. Never embed credentials inline in generated code. Run hookmyapp sandbox env --write .env or hookmyapp channels env <channel> --write (which mints a fresh gateway hmat_ access token) and let the user's app read from environment variables.
• There is no environment to select. Every command runs against the live HookMyApp service. Pass --workspace <id> only when the user has multiple workspaces and a command must hit one other than the active default.
• Browser steps cannot be automated. login and channels connect both open browser tabs the human must complete. Do not pretend to automate them — hand the terminal back with a clear instruction.
• Sandbox is not your own channel. Sandbox is a HookMyApp-hosted test account with 5 env keys, no templates, and recipient pinned to the session phone. Your own channel is your WhatsApp number or Instagram account, with 6 env keys (from channels env) and full template support. The two are not interchangeable — pick one based on the user's goal before generating code.
• Your own channel has two webhook-delivery flavors: CLI tunnel OR your own URL. A connected channel can receive inbound webhooks via either (a) hookmyapp channels listen (the CLI provisions a per-channel Cloudflare tunnel — no public HTTPS URL required, designed for local dev / self-hosted agents / 24/7 hobby projects) or (b) hookmyapp channels webhook set <channel> --url https://... (your own public HTTPS endpoint, the classic deployed pattern). Pick CLI when the user is developing on localhost or running an always-on self-hosted agent (e.g. on a personal server or Raspberry Pi); pick URL when the user has a deployed backend ready to accept inbound webhooks. The two are mutually exclusive per channel — setting a URL while the CLI is listening evicts the CLI (it exits cleanly with a notice).

When to Prompt the Human

Use a > **HUMAN ACTION REQUIRED:** <action> blockquote whenever the next step is not automatable: