[SOLVED] Cannot Download Media from WhatsApp Business API - Working with Postman and cURL - Not working with NodeJS Fetch

Issue

I'm having issues trying to download media files from the WhatsApp Business API. Following along with their documentation (href="https://developers.facebook.com/docs/whatsapp/cloud-api/reference/media#download-media" rel="nofollow noreferrer">https://developers.facebook.com/docs/whatsapp/cloud-api/reference/media#download-media) they provide a cURL command that is successful in downloading a media file when used - however, the same request (I think) when done using NodeJS' fetch returns text/html responses with vague error wording and a 200 status code.

# Successful cURL:
curl "https://lookaside.fbsbx.com/whatsapp_business/attachments/?mid=281274211304477&ext=1705672414&hash=ATtH6AOGFu0RqEpENicHUg8HCUkVfwGzfrHVCdiE7J8AUA" --header "Authorization: Bearer ..."

// Successful cURL from child_process.exec:
exec(
  `curl --location "${mediaURL}" --header "Authorization: Bearer ..."`
);

// Unsuccessful fetch:
fetch(
  "https://lookaside.fbsbx.com/whatsapp_business/attachments/?mid=281274211304477&ext=1705672414&hash=ATtH6AOGFu0RqEpENicHUg8HCUkVfwGzfrHVCdiE7J8AUA",
  { headers: { Authorization: "Bearer ..." } }
);

Suggestion from WhatsApp Cloud API Receiving Images from Users Error is also unsuccessful, unfortunately:

// Also unsuccessful fetch:
fetch("https://lookaside.fbsbx.com/whatsapp_business/attachments/?mid=281274211304477&ext=1705672414&hash=ATtH6AOGFu0RqEpENicHUg8HCUkVfwGzfrHVCdiE7J8AUA", {
  headers: {
    Authorization: "Bearer ...",
    "User-Agent": "curl/7.64.1",
  },
})

Note: The lookaside.fbsbx.com URLs are all retrieved successfully from the WhatsApp Business APIs.

Per the documentation, a 404 error should occur if the link has expired, however, this isn't the case - and the access token hasn't expired either. Looking through the Community Forums, specifically https://developers.facebook.com/community/threads/1367000994138329/?join_id=f25971b6b4f9cc4, many conversations suggest that the User-Agent header should be spoofed - yet this doesn't seem to work either, although tweaking the User-Agent header within Postman yields varying results.

Successful in Postman:

Unsuccessful when User-Agent is adjusted in Postman:

Unsuccessful when User-Agent is removed in Postman:

Any suggestions would be greatly appreciated. I was unable to use the Meta for Developers' "Report a bug" forms as support appears to be unavailable for WhatsApp Business APIs.

Also seen posts: 1, 2 on StackOverflow; 1, 2, 3, 4, 5, 6 on Meta Support Forums.

Solution

What ended up working for me was swapping the fetch library. Swapping NodeJS native fetch for axios or using a ponyfill such as cross-fetch and setting the User-Agent header to "node";

When using cross-fetch, the following fetch worked:

import fetch from "cross-fetch";

fetch("https://lookaside.fbsbx.com/whatsapp_business/attachments/...", {
  headers: {
    Authorization: "Bearer ...",
    "User-Agent": "node",
  },
})

Note: There is a very similar snippet in the original question, whilst the User-Agent has changed the fetch appeared to work with the same value too.

Answered By - Dom Webber

Answer Checked By - Pedro (WPSolving Volunteer)