Generate a permanent token

The token on the API Setup page is temporary. It expires in 24 hours.

It will verify perfectly today. Tomorrow your bot stops answering, and it will look exactly like something broke overnight rather than like a token doing what it always said it would. Almost every "it worked yesterday" report is this.

A permanent token comes from a system user, which lives in your business portfolio, not in your app.

Create the system user

Business settings → Users → System users → Add. A name and the Admin role.

If there is no System users section, your app is not connected to a business portfolio — go back to creating your app.

Give it access to the assets

Still on the system user: Add assets. Grant it your app and your WhatsApp Business Account, with full control on both.

A token generated before this step will authenticate and then be unable to see your number. That comes back as a permissions error rather than a token error (codes 200 and 10), which sends people to re-check the token they just made.

Generate the token

Press Generate new token and pick your app. Then two things, both on that dialog:

1. Set expiry to "Never". It is a dropdown, it defaults to a fixed period, and it is chosen at generation time — you cannot change it afterwards. A token generated with the default expiry has to be generated again from scratch. This is the single most-missed step in the whole flow.

2. Tick exactly these three permissions:

business_management
whatsapp_business_management
whatsapp_business_messaging

All three, and each one for a different reason: reading your business assets, managing the WhatsApp account and its webhook subscription, and actually sending messages. Missing the third is the classic "verifies fine, cannot send" state.

Copy it now

The token is shown once. There is no way to read it again — if you lose it you generate a new one, which is not a disaster but is five minutes you did not need to spend.

Paste it straight into Configuration → Channels. Do not park it in a chat message, a notes app, or a spreadsheet on the way: it is a permanent credential to your business's messaging. We store it encrypted and never display it again beyond a masked tail.

Checking a token you already have

Meta's Access Token Debugger (opens in a new tab) shows an existing token's expiry and its permission list. If its expiry is anything other than "Never", or any of the three permissions above is missing, it is not the token you want — generate a new one rather than trying to amend it.

You will need to be signed in to Meta for that page to show you anything.