EvolutionAPI on Google Cloud Run
Evolution API is an open-source Node.js WhatsApp Business API gateway (built on the Baileys library) that provisions WhatsApp instances, sends and receives messages, and exposes a REST API plus a manager UI for wiring WhatsApp into other systems. This module deploys Evolution API on Cloud Run v2 on top of the App_CloudRun foundation, which provisions and manages the shared Google Cloud infrastructure.
This guide focuses on the cloud services Evolution API uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics common to every Cloud Run application — service identity, ingress and load balancing, scaling and concurrency, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_CloudRun foundation guide rather than repeating them here.
What Evolution API costs on RAD, and how that compares
In a Google Cloud project you own, Evolution API on RAD's Cloud Run module costs about US$181 a month, plus US$30 once per deployment and no per-user licence. GKE Autopilot is the alternative for workloads that must stay up continuously or run beside other Kubernetes apps; see the GKE guide, about US$150 a month. Evolution API is an open-source WhatsApp Business API gateway used to send and receive messages and manage multiple instances programmatically. Figures are as at 8 October 2026; sources are listed at the end of this section.
If this runs in a project RAD manages for you, it can be deleted and restored within 30 days for a few credits instead of sitting there running — so an occasional-use deployment costs a few dollars a month, not US$181. See Pause it for free, below.
What you pay on RAD
| In a Google Cloud project you own | In a project RAD manages for you | |
|---|---|---|
| Module fee, once per deployment | 300 credits (US$30 at the top-up price) | 270 credits (10% lower) |
| Build time | A few credits per build | The same |
| Google Cloud running cost | Billed by Google to your own billing account, about US$181 a month for the default configuration (table below) | Metered hourly in credits; RAD publishes 83 credits a day, about 2,490 a month (about US$249 at the top-up price) |
| Who owns what | You own the project and its billing; RAD deploys and updates it | RAD owns the project, with guardrails, quotas and budget alerts; you get console access, and a minimum purchased balance is held in reserve |
10 credits cost US$1 on a one-off top-up, and less on a monthly plan. In a project RAD manages, the database, file server and network are shared by every application in the project, so a second application does not add a second database.
Default running cost in your own project (us-central1, Google list prices):
| Resource (module default) | Per month |
|---|---|
| Cloud Run, 2 vCPU / 4 GiB, always on | US$110 |
| Cloud SQL for PostgreSQL, 1 vCPU / 3.75 GB, zonal, 10 GB SSD | US$51 |
| NFS/cache file server: a small VM | US$13 |
| Cloud NAT gateway and IP address | US$5 |
| Cloud Storage for add-ons and backups | US$1 |
| Total | about US$181 |
How it compares
We could not find a commercial managed/SaaS plan specifically for Evolution API itself as at 8 October 2026, so the honest comparison is against running it yourself:
| Option | Per month | Who runs it |
|---|---|---|
| Hetzner CPX22 (2 vCPU/4GB) | ~US$24 | You: OS, updates, backups, security patches |
| DigitalOcean 2 vCPU/4GB Droplet | US$24 | You: OS, updates, backups, security patches |
| GCP Compute Engine e2-standard-2 (2 vCPU/8GB) | ~US$49 | You: OS, updates, backups, security patches |
| RAD, Cloud Run, your own project | US$181, plus US$30 once | RAD's automation, in your project |
| RAD, GKE Autopilot | about US$150; see the GKE Autopilot guide | RAD |
- RAD is usually not cheaper in cash than a bare VPS — the difference is what is managed for you. A VPS price does not include the admin's own time for backups, security patches and OS upgrades; RAD's managed Cloud SQL (where this app uses a database), Secret Manager and monitoring cover that instead.
- Evolution API is an open-source WhatsApp Business API gateway used to send and receive messages and manage multiple instances programmatically. That shapes which column matters: predictable, hands-off operation is worth more to most teams running this kind of tool than shaving a few dollars off the monthly bill.
Pause it for free: delete a RAD-managed project, restore it when you need it
If Evolution API runs in a project RAD manages for you, you have an option beyond scaling down: delete the whole project, and restore it within 30 days for close to nothing. This suits a deployment you only need occasionally — studying for a certification, a demo, a seasonal need — far better than running it continuously.
- How it works. Deleting a RAD-managed project unlinks its billing first, then asks Google to delete the project. Google does not remove it immediately: it keeps it, recoverable, for 30 days, and because billing is already unlinked, nothing is charged while it waits. Unlike deleting one module, this does not tear down Cloud SQL, the VM or Cloud Run one by one — the whole project, and everything in it, simply stops.
- Restoring costs a handful of credits, not a rebuild. Within 30 days, the project's owner can restore it. RAD asks Google to undelete the project and reattaches its billing account, then asks you to run Update on each deployment to confirm everything came back. Because nothing was individually destroyed, that Update finds the same resources already there — it is a check, not a rebuild, and an Update never charges the module fee again. That costs a handful of build-time credits in total (under US$1) for a typical 2–3-deployment chain.
- So a month of occasional use can cost a few dollars, not US$181. Deploy Evolution API, use it for a session, delete the project. Restore it next time you want it, confirm with Update, and delete it again when you're done. You pay only for the module fee once, the builds, and whatever hours it was actually live.
- What this needs. You must own the project (not a bring-your-own one RAD only manages billing for), and you restore it yourself within the 30 days — after that, Google deletes it for good. Restoring is admitted like creating a new project: your purchased credit balance must still clear the tier's floor (100 credits for the sandbox tier most study/demo use fits). Google says most services are fully working again within 36 hours of a restore.
- One real gap: nightly backups do not survive. Backups are written to a bucket inside the project, and that bucket has Cloud Storage's soft-delete explicitly turned off, so it is very likely gone as soon as you delete the project — even though the project itself is recoverable for 30 days. If you've customised this deployment and want to keep that work, copy a backup out (to Google Drive, or a bucket outside the project) before deleting. For a default install with nothing irreplaceable in it, this does not matter.
Pay only while you use it, the other way: delete and redeploy
This module runs Cloud Run continuously (alwaysOn) rather than scaling to zero, so its compute cost does not stop on its own between sessions. The option above only applies to a RAD-managed project; in your own project, or once the 30-day window has passed, the way to stop paying is to delete the deployment and deploy it again when you need it.
- What a redeploy costs. The module fee again plus the builds: about 305 credits (US$30.50). Deleting saves money if Evolution API would otherwise sit unused for about 6 days or more in your own project (about US$6.03 a day), or about 4 days or more in a RAD-managed one (83 credits a day).
- Delete everything Evolution API uses. Most of the running cost is usually the database and any shared file/cache VM. They stop only when nothing else in the project uses them, so deleting this app while something else shares the project saves only this app's own compute part.
- Keep data first. Nightly backups go to a bucket inside the deployment and are deleted with it, so copy the latest backup out before deleting if you want to keep it.
- Note your settings. RAD does not recreate a deleted deployment for you; you enter the settings again when you deploy.
Lab sessions and Managed Environments
- Lab sessions, for training. A trainer runs a session for a class. Each participant gets Evolution API in their own Google Cloud project for 15 minutes to 24 hours, within an allowance the trainer sets. Either the trainer funds every place, or each participant pays for their own. Everything is deleted when the session ends and unused credits go back to the trainer.
- Managed Environments, for consultancies. A partner runs the app for a client from a ring-fenced wallet it funds, and settles with the client directly. If the wallet runs low, billing pauses and the data is kept, so nobody receives an unexpected charge. At the end the partner hands the project over and the deployments become the client's own.
Credits can be bought in more than 20 currencies, including XAF, XOF, NGN, GHS, KES and ZAR, by card, bank transfer or mobile money.
Sources (8 October 2026): Google Cloud list prices from the Cloud Billing Catalog API; RAD's own fees and daily-credit estimate from radmodules.dev/pricing; Delete and restore projects for the pause/restore mechanism. Prices change; check each source before relying on a figure.
1. Overview
Evolution API runs as a Node.js container on Cloud Run v2. The deployment wires together a focused set of Google Cloud services:
| Capability | Google Cloud service | Notes |
|---|---|---|
| Compute | Cloud Run v2 | Node.js service, 2 vCPU / 4 GiB by default; pinned to a single always-warm instance |
| Database | Cloud SQL for PostgreSQL 15 | Required — Evolution API uses Prisma against PostgreSQL only |
| Cache | Redis | Enabled by default (CACHE_REDIS_URI); caches instance/message state |
| Object storage | Cloud Storage | A dedicated data bucket provisioned automatically |
| Secrets | Secret Manager | Auto-generated AUTHENTICATION_API_KEY; database password |
| Ingress | Cloud Run URL / Cloud Load Balancing | Default run.app URL (public); optional external HTTPS LB + custom domain |
Sensible defaults worth knowing up front:
- PostgreSQL 15 is mandatory. The database engine is fixed by the shared application layer; Evolution API uses Prisma and does not support other engines.
- The service is pinned to a single instance (
min_instance_count = 1,max_instance_count = 1). Evolution API holds live WhatsApp (Baileys) socket sessions in memory, per-instance; those sessions are not shared across replicas, so scaling out fragments live connections and one instance must stay warm. Do not raisemax_instance_count. AUTHENTICATION_API_KEYis generated automatically and stored in Secret Manager. It is Evolution API's global admin key and must never be rotated after first boot — rotating it makes already-provisioned WhatsApp instances unreachable and returns401to every client still holding the old key.- Redis is enabled by default (
enable_redis = true). Leaveredis_hostempty to use the NFS server VM's IP as the Redis endpoint (requiresenable_nfs = true), or point it at an explicit managed instance. - Public ingress is the default (
ingress_settings = "all") so external systems can reach webhook endpoints and the manager UI. Enabling IAP blocks those external calls. - Memory defaults to 4 GiB — Evolution API needs at least 2 GiB for reliable operation.
SERVER_URLis defaulted to the actual service URL at runtime by the container entrypoint, so QR-code and webhook callback URLs reflect the real Cloud Run address.
2. Google Cloud Services & How to Explore Them
All commands assume PROJECT and REGION are set. Service and resource names are
reported in the deployment Outputs.
A. Cloud Run — the Evolution API service
Evolution API runs as a Cloud Run v2 service pinned to a single instance. Each deployment creates an immutable revision; traffic can be split across revisions for safe rollouts.
- Console: Cloud Run → select the service for revisions, traffic, logs, and metrics.
- CLI:
gcloud run services list --project "$PROJECT" --region "$REGION" \
--filter="metadata.name~evolutionapi"
gcloud run services describe <service-name> --project "$PROJECT" --region "$REGION"
gcloud run revisions list --service <service-name> --project "$PROJECT" --region "$REGION"
See App_CloudRun for scaling, concurrency, execution environment, and traffic splitting.
B. Cloud SQL for PostgreSQL 15
Evolution API stores all application data (WhatsApp instances, contacts, chats, message history) in a managed Cloud SQL for PostgreSQL 15 instance. The service connects privately through the Cloud SQL Auth Proxy over a Unix socket; no public IP is exposed. On first deploy an initialization Job creates the application database and user; Prisma migrations then create the schema on container boot.
- Console: SQL → select the instance for connections, backups, flags, metrics.
- CLI:
gcloud sql instances list --project "$PROJECT"
gcloud sql instances describe <instance-name> --project "$PROJECT"
gcloud sql connect <instance-name> --user=evolution --database=evolution --project "$PROJECT"
The instance name, database, user, and password secret are in the Outputs. See App_CloudRun for the connection model, backups, and password rotation.
C. Cloud Storage
A dedicated Cloud Storage data bucket is provisioned automatically for Evolution
API file storage. Additional buckets can be declared via storage_buckets.
- Console: Cloud Storage → Buckets.
- CLI:
gcloud storage buckets list --project "$PROJECT"
gcloud storage ls gs://<data-bucket>/ # bucket name is in the Outputs
See App_CloudRun for GCS Fuse and CMEK options.
D. Redis (cache)
Redis is enabled by default (enable_redis = true). Evolution API uses it for
instance/message caching (CACHE_REDIS_URI, Redis DB index 6). When redis_host is
left empty and enable_nfs = true, the NFS server VM's IP is used as the Redis
endpoint; the container entrypoint assembles the URI at runtime.
- Console: Memorystore → Redis (if using a managed instance).
- CLI:
redis-cli -h <redis-host> ping
redis-cli -h <redis-host> info keyspace
# Confirm the cache URI is set in the running revision:
gcloud run services describe <service-name> --region "$REGION" \
--format='value(spec.template.spec.containers[0].env)'
E. Secret Manager
One cryptographic secret is generated automatically and stored in Secret Manager:
AUTHENTICATION_API_KEY — Evolution API's global admin API key, injected as a secret
env var. The database password is managed separately by the foundation.
- Console: Security → Secret Manager.
- CLI:
gcloud secrets list --project "$PROJECT" --filter="name~api-key"
gcloud secrets versions access latest --secret=<secret-name> --project "$PROJECT"
See App_CloudRun for injection and rotation details.
F. Networking & ingress
The service is reachable at its run.app URL by default, which allows the public
access required for WhatsApp webhook callbacks and the manager UI. An external HTTPS
load balancer with a custom domain, Cloud CDN, and Cloud Armor can be layered on;
ingress settings and VPC egress control connectivity.
- Console: Cloud Run (service URL); Network services → Load balancing.
- CLI:
gcloud run services describe <service-name> --region "$REGION" --format='value(status.url)'
gcloud compute addresses list --project "$PROJECT"
See App_CloudRun.
G. Cloud Logging & Monitoring
Container logs flow to Cloud Logging; Cloud Run and Cloud SQL metrics flow to Cloud
Monitoring, with optional uptime checks and alert policies. The entrypoint emits
[cloud-entrypoint] markers that confirm the resolved DB/Redis/URL config on boot.
- Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.
- CLI:
gcloud run services logs read <service-name> --project "$PROJECT" --region "$REGION" --limit 50
3. EvolutionAPI Application Behaviour
- First-deploy database setup. An initialization Job runs
db-init.shusingpostgres:15-alpine. It connects through the Cloud SQL Auth Proxy and idempotently creates theevolutiondatabase and role, grants privileges, and makes the app user the owner of thepublicschema. The job is safe to re-run. - Prisma migrations on start. Evolution API runs
prisma migrate deployon every container boot (via the wrappeddeploy_database.sh), so upgrading the application version applies schema changes without a separate migration step. The entrypoint waits for the Cloud SQL socket before this runs and executes the migrate script as a subprocess so a transient failure cannot prevent the server from starting. AUTHENTICATION_API_KEYis immutable after first boot. The global admin key is generated once and written to Secret Manager. Rotating it makes all already-provisioned WhatsApp instances unreachable and returns401to every client still holding the old key. Only rotate during a planned migration.- Single-instance by design. WhatsApp (Baileys) socket sessions live in the
instance's memory and are not shared across replicas.
min_instance_count = 1keeps one warm;max_instance_count = 1prevents fragmenting live connections. Do not scale out. - Webhook / QR callback URL. The entrypoint defaults
SERVER_URLto the injectedCLOUDRUN_SERVICE_URL, so QR-code and webhook callback URLs use the real service address. Verify the running service URL:gcloud run services describe <service-name> \
--region "$REGION" --project "$PROJECT" --format='value(status.url)' - First-run setup. After deploy, retrieve
AUTHENTICATION_API_KEYfrom Secret Manager and use it (as theapikeyheader) to reach the manager UI at/manager, create a WhatsApp instance (POST /instance/create), then scan the returned QR code from WhatsApp on your phone to connect the number. - Health path. Startup and liveness probes target the root
/— an unauthenticated status endpoint that responds once the server is up. Allow ~7 minutes on first boot (the startup probe gives a 60-second initial delay plus a 30-retry window while Prisma migrates). - Inspect job execution:
gcloud run jobs list --project "$PROJECT" --region "$REGION"
gcloud run jobs executions list --job <job-name> --project "$PROJECT" --region "$REGION"
4. Configuration Variables
Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for Evolution API are listed; every other input is inherited from App_CloudRun with its standard behaviour.
Group 1 — Project & Identity
| Variable | Default | Description |
|---|---|---|
project_id | (required) | Target Google Cloud project. |
region | us-central1 | Region for the service and regional resources. |
All other inputs follow standard App_CloudRun behaviour.
Group 3 — Application Identity
| Variable | Default | Description |
|---|---|---|
application_name | evolutionapi | Base name for resources. Do not change after first deploy. |
display_name | Evolution API | Human-readable name shown in the Console. |
application_version | v2.1.1 | Evolution API image tag. latest maps to a pinned v2.1.1 in the build arg. |
All other inputs follow standard App_CloudRun behaviour.
Group 4 — Runtime & Scaling
| Variable | Default | Description |
|---|---|---|
deploy_application | true | Set false to provision infrastructure only. |
cpu_limit | 2000m | CPU per instance; 2 vCPU recommended. |
memory_limit | 4Gi | Memory per instance; minimum 2 GiB for reliable operation. |
min_instance_count | 1 | Keeps one warm instance — WhatsApp sockets are held in memory. |
max_instance_count | 1 | Pinned to 1. Do not raise — sessions are not shared across replicas. |
container_port | 8080 | Evolution API listens on port 8080 (SERVER_PORT). |
enable_cloudsql_volume | true | Cloud SQL Auth Proxy sidecar for socket connections. |
enable_image_mirroring | true | Mirror the evoapicloud/evolution-api image into Artifact Registry. |
All other inputs follow standard App_CloudRun behaviour.
Group 5 — Access & Ingress Control
| Variable | Default | Description |
|---|---|---|
ingress_settings | all | all is required for public webhook callbacks and the manager UI. |
enable_iap | false | Require Google sign-in. Blocks external WhatsApp webhook callbacks. |
All other inputs follow standard App_CloudRun behaviour.
Group 6 — Environment Variables & Secrets
| Variable | Default | Description |
|---|---|---|
environment_variables | {} | Extra non-secret settings. Core SERVER_*, DATABASE_*, CACHE_REDIS_*, and AUTHENTICATION_* values are set automatically — do not set AUTHENTICATION_API_KEY or DATABASE_CONNECTION_URI here. |
secret_environment_variables | {} | Map of env var → Secret Manager secret name. |
All other inputs follow standard App_CloudRun behaviour.
Group 11 — Storage & Filesystem
| Variable | Default | Description |
|---|---|---|
enable_nfs | true | Provisions a Filestore NFS instance; also co-locates the Redis endpoint on the NFS server VM when redis_host is left empty (see Group 21). |
gcs_volumes | [] | GCS Fuse volume mounts (requires gen2). |
All other inputs follow standard App_CloudRun behaviour.
Group 12 — Database Backend
| Variable | Default | Description |
|---|---|---|
db_name | evolution | PostgreSQL database name. Immutable after first deploy. |
db_user | evolution | Application database user. Password auto-generated in Secret Manager. |
All other inputs follow standard App_CloudRun behaviour.
Group 14 — Observability & Health
| Variable | Default | Description |
|---|---|---|
startup_probe | HTTP / 60s delay, 30 retries | Slow first boot (Prisma migrations); allow ~7 minutes. |
liveness_probe | HTTP / 60s delay | Liveness probe on the root status endpoint. |
All other inputs follow standard App_CloudRun behaviour.
Group 21 — Redis Cache
| Variable | Default | Description |
|---|---|---|
enable_redis | true | Enables Evolution API's Redis cache (CACHE_REDIS_URI). |
redis_host | "" | Redis endpoint. Leave empty to use the NFS server IP (requires enable_nfs = true). |
redis_port | 6379 | Redis port. |
redis_auth | "" | Optional Redis auth password (sensitive). |
All other inputs follow standard App_CloudRun behaviour.
5. Outputs
Returned on a successful deployment — the quickest way to locate and explore the running resources.
| Output | Description |
|---|---|
service_name | Cloud Run service name. |
service_url | Default run.app URL of the service. |
service_location | Region the service runs in. |
stage_services | Stage-specific service details (Cloud Deploy). |
load_balancer_ip / load_balancer_url | External HTTPS load balancer IP / URL (when enabled). |
database_instance_name | Cloud SQL instance name. |
database_name / database_user | Application database name / user. |
database_password_secret | Secret Manager secret holding the DB password. |
database_host / database_port | DB endpoint (sensitive) / port. |
storage_buckets | Created Cloud Storage buckets. |
network_name / network_exists / regions | VPC network, presence, regions. |
container_image / container_registry | Deployed image and Artifact Registry repo. |
monitoring_enabled / monitoring_notification_channels / uptime_check_names | Monitoring status, channels, uptime checks. |
initialization_jobs | Names of the setup jobs. |
deployment_id / tenant_id / resource_prefix | Naming identifiers. |
project_id / project_number | Project identifiers. |
cicd_enabled / github_repository_url / github_repository_owner / github_repository_name / cicd_configuration | CI/CD status and details. |
artifact_registry_repository / cloudbuild_trigger_name / cloudbuild_trigger_id | Registry and build trigger. |
vpc_sc_enabled / vpc_sc_perimeter_name / vpc_sc_dry_run_mode | VPC-SC status. |
audit_logging_enabled / artifact_registry_cmek_enabled | Audit logging and CMEK status. |
6. Configuration Pitfalls & Sensible Defaults
Risk: Critical (data loss / outage / security) — High (service degraded) — Medium (cost or partial degradation) — Low (minor).
Inherited plan-time validation. This module passes its configuration through the App_CloudRun foundation engine, which validates values and combinations at plan time — an out-of-range
redis_port/backup_retention_days, IAP with no authorized identities, agen1runtime with NFS/GCS mounts, memory below the gen2 floor. Invalid configuration fails the plan with a clear, named error before any resource is created, so most mistakes below are caught up front rather than at apply or runtime.
| Setting | Sensible value | Risk | Consequence if wrong |
|---|---|---|---|
AUTHENTICATION_API_KEY (auto-generated) | Never rotate after first boot | Critical | Rotating it makes every already-provisioned WhatsApp instance unreachable and returns 401 to all clients holding the old key. |
db_name / db_user | Set once | Critical | Immutable after first deploy; renaming recreates the DB/user and destroys all message history. |
max_instance_count | 1 | Critical | Scaling out fragments in-memory WhatsApp socket sessions across instances, breaking live connections and duplicating webhook deliveries. |
enable_backup_import | false unless restoring | Critical | Enabling without a valid backup_uri fails the import job. |
enable_redis | true | High | Disabling drops Evolution API's instance/message cache; the app is configured to expect it (CACHE_REDIS_ENABLED = true). |
redis_host | "" (NFS) or explicit | High | When Redis is on but NFS is off and no host is set, the cache URI is blank and caching is silently disabled. |
memory_limit | 4Gi (min 2Gi) | High | Below 2 GiB Evolution API is prone to OOM kills under message load. |
ingress_settings | all | High | Setting to internal blocks all external WhatsApp webhook callbacks. |
enable_iap | only when webhooks not needed | High | IAP blocks all unauthenticated requests, including external webhook callbacks. |
min_instance_count | 1 | Medium | Scale-to-zero drops the warm WhatsApp socket sessions; a cold start must re-establish every connection. |
application_version | Pin (e.g. v2.1.1) | Medium | latest maps to a pinned tag, but pinning explicitly avoids surprise upgrades that run new Prisma migrations. |
startup_probe timing | Default (60s + 30 retries) | Medium | Too tight a window fails the probe before first-boot Prisma migrations finish. |
For the foundation behaviour referenced throughout — service identity, scaling and concurrency, ingress and load balancing, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC-SC, backups, and image mirroring — see App_CloudRun. Evolution-API-specific application configuration shared with the GKE variant is described in EvolutionAPI_Common.
Related guides
- Hands-on lab: Evolution API on Cloud Run — deploy it step by step, with the console screens and commands at each stage.
- EvolutionAPI on GKE Autopilot — the same application on Kubernetes, for when you need the other deployment target.
- EvolutionAPI Common — Shared Application Configuration — the configuration shared by both deployment targets.
- Deployed alongside Chatwoot on Google Cloud Run, n8n on Google Cloud Run, Listmonk on Google Cloud Run, Ntfy on Google Cloud Run in the Conversational Outreach solution.
Need RAD to do something it does not do yet? Request it on the roadmap, or vote on what is already there.