System-user access token
Create a system user, assign the right assets and permissions, and generate the token this platform uses to send on your behalf.
The access token is what lets this platform act for your business. It is the single most error-prone value in the whole setup, so this page is deliberately detailed.
Use a system user, not your personal token
Meta's API Setup page shows a temporary token that expires in 24 hours. It is for testing. If you paste it into the app, your connection breaks tomorrow. You need a system-user token.
Create the system user
Open Business Settings → Users → System users
You must be an admin of the Business Manager, and two-factor authentication must be on. If the Add button is greyed out, one of those two is missing.
Click Add and name it
Something descriptive like "WhatsApp Integration". Give it the Admin system-user role.
Assign the assets — the step everyone skips
A system user with no assets can authenticate and do nothing. Meta returns a permissions error that does not explain this, so assign both:
With the system user selected, click Add assets
Go to Apps, choose the app you created, and enable Manage app (full control).
Add assets again
Go to WhatsApp accounts, choose your WABA, and enable Full control.
Both are required
The app alone is not enough, and the WABA alone is not enough. If sending fails with a permissions error after everything else looks right, come back and check this page first.
Generate the token
Click Generate new token
Select the app you assigned above.
Choose the expiry
Never is the right choice for a production integration. A 60-day token means your connection silently dies in 60 days and every message starts failing.
Tick these permissions
whatsapp_business_messaging— send and receive messages. Required.whatsapp_business_management— manage templates, numbers and the WABA. Required.business_management— read business assets. Recommended.catalog_management— only if you will use the product catalog and orders.
Copy the token immediately
It is shown exactly once. Close the dialog without copying and you have to generate a new one.
Treat this like a password
Anyone holding this token can send WhatsApp messages as your business. Do not email it, do not paste it into a group chat, and do not commit it anywhere. Paste it straight into the setup wizard.
Token expiry and rotation
If you chose Never, the token lasts until you revoke it. It can still be invalidated by:
- Removing the system user, the app, or the asset assignments
- An admin revoking it in Business Settings
- Meta invalidating it for a security event, such as an admin password change
The app monitors token health and shows a red banner across the top if your token is expiring, expired or invalid — messaging stops working entirely when a token dies, so it is not a quiet failure.
Rotating a token
Generate a new token on the same system user
Same permissions as above.
Update it in the app
Settings → Connections, open your connection, and paste the new token.
Only then revoke the old one
In that order, so you never have a gap where messages fail.
Next
You now have everything. Connect it to the app.