[GOWS] Error 463 on send to cold contacts — tctoken/cstoken not included in outgoing messages

[m0d02x]

Description

Sending messages to contacts with no prior conversation history fails with gRPC error 463 on GOWS engine (PLUS tier).

{
  "statusCode": 500,
  "exception": {
    "message": "2 UNKNOWN: server returned error 463",
    "code": 2
  }
}

Environment

• WAHA version: 2026.3.1
• Engine: GOWS
• Tier: PLUS
• Platform: linux/x64

Root Cause

Per Baileys #2441 investigation:

• Error 463 = NackCallerReachoutTimelocked — WhatsApp server-side "reach-out time-lock" rate limit
• Affects messages to unknown/cold contacts (no prior conversation)
• Caused by missing tctoken and cstoken privacy fields in outgoing <message> nodes
• WhatsApp counts messages without these fields as "reaching out" and enforces time-based locks
• Confirmed: the fix was implemented in Baileys PRs #2257, #2339, and #2438

Expected Behavior

Messages should include tctoken/cstoken to avoid triggering the reach-out time-lock, matching official WhatsApp client behavior.

Actual Behavior

GOWS engine omits these tokens, causing 463 errors on cold contacts. Sending to existing contacts works fine.

Steps to Reproduce

1. Create a GOWS PLUS session
2. Attempt to send a message to a phone number that has never chatted with the session before
3. Observe 500 error with gRPC error 463

Related

• Duplicate of [GOWS] - POST /api/sendText retorna erro 500 (gRPC error 463) #1904 (same error, now with root cause identified)
• Baileys investigation #2441
• Baileys tctoken PR #2257
• Baileys cstoken PR #2438

[bergpinheiro]

We have a limit of 300 new conversations initiated with contacts we've never spoken to before. Customers have even reported this restriction within the app.

[trojantm]

tulir/whatsmeow#1081
Perhaps it's related.

[noeroelama]

+1

[joaoAPina]

+1

[tangjiachao]

大概啥时候修复呀

[github-actions]

English

---

When will it be fixed?

[joaoAPina]

+1

[joaoAPina]

{
"message": "Failed to send text message",
"severity": "error",
"attributes": {
"time": 1779712322911,
"pid": 12,
"hostname": "9008673d48a1",
"module": "waha-api",
"status": 500,
"errorMessage": "Request failed with status code 500",
"responseBody": {
"statusCode": 500,
"timestamp": "2026-05-25T12:32:02.909Z",
"exception": {
"message": "2 UNKNOWN: server returned error 463",
"code": 2,
"details": "server returned error 463",
"metadata": {},
"name": "Error",
"stack": "Error: 2 UNKNOWN: server returned error 463\n at callErrorFromStatus (/app/node_modules/@grpc/grpc-js/build/src/call.js:32:19)\n at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/build/src/client.js:193:76)\n at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:367:141)\n at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:327:181)\n at /app/node_modules/@grpc/grpc-js/build/src/resolving-call.js:135:78\n at process.processTicksAndRejections (node:internal/process/task_queues:84:11)\nfor call at\n at MessageServiceClient.makeUnaryRequest (/app/node_modules/@grpc/grpc-js/build/src/client.js:161:32)\n at MessageServiceClient.SendMessage (/app/node_modules/@grpc/grpc-js/build/src/make-client.js:105:19)\n at MessageServiceClient.SendMessage (/app/dist/core/engines/gows/grpc/gows.js:10502:30)\n at node:internal/util:495:21\n at new Promise ()\n at node:internal/util:481:12\n at WhatsappSessionGoWSPlus.sendText (/app/dist/core/engines/gows/session.gows.core.js:518:78)\n at descriptor.value (/app/dist/core/abc/activity.js:9:35)\n at process.processTicksAndRejections (node:internal/process/task_queues:103:5)"
},
"request": {
"path": "/api/sendText",
"method": "POST",
"body": {
"session": "019bdbb3-84ca-7000-9287-590ccacc25c6",
"chatId": "135051270430835@lid",
"text": "Vou te passar o contato responsável!"
},
"query": {}
},
"version": {
"version": "2026.4.3",
"engine": "GOWS",
"tier": "PLUS",
"browser": null,
"platform": "linux/x64",
"worker": {
"id": null
}
}
},
"session": "019bdbb3-84ca-7000-9287-590ccacc25c6",
"chatId": "135051270430835@lid",
"level": "error"
},
"tags": {
"project": "7d15f083-1611-411d-8692-fd30f2b6bc40",
"environment": "6f8caaf3-1571-4c87-86e8-5968b9990a1a",
"service": "9f735920-43a1-43ea-8d4e-997510e80d07",
"deployment": "af71b982-26c4-44db-ae3b-8a08248388be",
"replica": "f03c4a2b-caea-4d3b-a5c0-333a0b996ed1"
},
"timestamp": "2026-05-25T12:32:02.930675381Z"
}

[dv336699]

+1 @devlikepro

[mrbitencourt]

+1

[hardeep-97]

I’m facing the same issue on 2026.1.4 with GOWS PLUS.

This started after the WhatsApp number was temporarily flagged/restricted by Meta as spam. Later the restriction was removed and I was able to create the session again successfully, but now every sendText or any api request fails with:

{
  "statusCode": 500,
  "exception": {
    "message": "2 UNKNOWN: server returned error 463"
  }
}

Important observations:

• Another old number works perfectly on the same WAHA build/server. when i tried new one it fails with same error.
• I also tried changing the VPS/server IP and recreating the session, but the issue still persists.
• QR login and session creation work fine.

So this seems tied to the specific WhatsApp account state after the spam restriction was removed.

Has anyone found a fix or recovery method for this?