LINE Messaging API guide: messages, webhooks and pricing

The LINE Messaging API is how your own software talks through a LINE Official Account. Without it, people answer chats by hand in LINE Official Account Manager. With it, a booking system can confirm an appointment, a shop can send an order update, and a chatbot can answer the same question for the hundredth time without anyone typing.

This guide covers what the API does, the message types, how webhooks work and how to verify them, what messages cost in Thailand, and a small Node.js bot you can run. It is written by the team that builds LINE chatbots and Messaging API integrations and runs FoxConnect’s booking messages on it every day. If you are still choosing between LINE tools, start with LINE OA vs LIFF vs LINE MINI App.

What the Messaging API does

It works in two directions:

• LINE to you (webhooks). When a customer adds your account, sends a message, taps a rich menu button or a button in a message, LINE sends an HTTPS request with the event to a URL you choose.
• You to LINE (API calls). Your server calls the API with a channel access token to send messages, read a customer’s display name, change their rich menu and more.

You set it up in the LINE Developers Console: a Messaging API channel linked to your Official Account, a channel secret (to check webhooks) and a channel access token (to call the API).

Message types

A request can carry up to five message objects. The main types:

Type	What it is	Typical use
Text	Plain text, with emoji	Answers, confirmations
Sticker	A LINE sticker	A friendly reply
Image, video, audio	Media from an HTTPS URL	Menus, how-to videos
Location	A pin with an address	Directions to the shop
Imagemap	An image with tappable areas	Promotions
Template	Buttons, confirm, carousel	Simple choices
Flex Message	A layout you design in JSON	Receipts, booking cards

Any of them can carry quick reply buttons that appear above the keyboard. For anything that looks like a card, such as a booking summary with a “Change time” button, Flex Messages are the right choice.

Webhooks and signature verification

Every webhook request has an x-line-signature header: an HMAC-SHA256 of the raw request body, keyed with your channel secret, in Base64. Check it before you do anything with the body. Without the check, anyone who finds your webhook URL can send fake “customer” messages into your system.

Three rules that save trouble later:

1. Compute the signature on the raw bytes, before any JSON parser touches the body, and compare with a constant-time function. The SDK’s middleware() and validateSignature() do both.
2. Answer quickly with HTTP 200 and do slow work after, or in a queue.
3. Expect repeats. If webhook redelivery is on, LINE can send the same event again. Each event has a webhookEventId; store it and skip events you have already handled. That matters for anything involving money or points.

Reply messages use a replyToken from the event. It works only once and only for a short time after the event, so reply straight away and use a push message for anything that comes later.

Pricing per message in Thailand (as of October 2026)

The Messaging API has no fee of its own. Messages are counted against your LINE Official Account plan. According to LINE for Business Thailand, checked on 29 October 2026:

Plan	Price per month	Messages included	Extra messages
Free	฿0	300	Not available
Basic	฿1,280	15,000	฿0.10 each
Pro	฿1,780	35,000	฿0.06 each

Prices exclude 7% VAT. How the count works, from LINE’s Messaging API pricing page:

• Reply messages are not counted. Push, multicast, broadcast and narrowcast messages are.
• Messages are counted per recipient, not per message object. One push with four bubbles to one person is one message; a push to a five-person group is five.
• Messages to people who blocked your account are not counted.
• When the quota runs out, sends fail with an error. On Basic and Pro you can allow extra messages up to a cap in LINE Official Account Manager.

LINE sets plans per country and changes them (Japan revised its extra-message fees on 1 October 2026, Taiwan revises its plans on 1 November 2026), so check the Thai page before you budget a large campaign.

A small bot in Node.js

This uses the official @line/bot-sdk, version 11 (current in October 2026; it needs Node.js 22 or later), with Express. It verifies the signature and echoes text messages back as a free reply.

npm install @line/bot-sdk express

// server.mjs
import express from 'express';
import { LineBotClient, middleware, SignatureValidationFailed } from '@line/bot-sdk';

const client = LineBotClient.fromChannelAccessToken({
  channelAccessToken: process.env.LINE_CHANNEL_ACCESS_TOKEN,
});

const app = express();

// middleware() reads the raw body, checks x-line-signature with the channel secret
// and then parses the JSON. Don't put express.json() in front of this route.
app.post('/webhook', middleware({ channelSecret: process.env.LINE_CHANNEL_SECRET }), async (req, res) => {
  for (const event of req.body.events) {
    if (event.type === 'message' && event.message.type === 'text') {
      await client.replyMessage({
        replyToken: event.replyToken,
        messages: [{ type: 'text', text: `You wrote: ${event.message.text}` }],
      });
    }
  }
  res.sendStatus(200);
});

// A bad or missing signature: refuse the request.
app.use((err, req, res, next) => {
  if (err instanceof SignatureValidationFailed) return res.sendStatus(401);
  next(err);
});

app.listen(3000);

This echo bot answers before it returns 200, which is fine for a quick text reply. A real bot follows the three rules above: it returns 200 straight away, puts each event in a queue and skips any webhookEventId it has already handled.

Put the public HTTPS URL of /webhook in the Developers Console, turn on “Use webhook” and press “Verify”. To send a message later, for example a reminder, use client.pushMessage({ to: userId, messages: [...] }); that one counts toward your quota. The LINE Notify replacement guide shows a push to a group.

Where the real work is

The echo bot takes an afternoon. The work in a real project is what sits behind it: matching a LINE user to a customer record with consent, booking rules, retries that never double-charge, and staff who can take over a chat. We wrote about the customer-data side in connecting LINE to your CRM, and the FoxConnect case study shows a production system built this way.

If you want a chatbot or a Messaging API integration built for your business, see LINE chatbot development or the overview of our LINE development work.