Glossary
What is a WhatsApp access token, and how do you get one?
The secret key that lets software call the WhatsApp Cloud API, why production setups use a system user in the business portfolio, and what to do if a token leaks.
By Broadchat teamPublished Updated 4 min read
Definition
Access token (system user): An access token is the secret string an app sends with every WhatsApp Cloud API request to prove it is allowed to act for a WhatsApp Business account. Production systems usually create it for a system user, a non-human account inside the business portfolio, so it does not expire when an employee leaves. It carries permissions such as whatsapp_business_messaging and whatsapp_business_management and must be kept secret.
Also called: System user token, Permanent access token, Bearer token
How access tokens work
Every call to the Cloud API, such as sending a message to a phone number ID or creating a template, includes a WhatsApp API access token in the Authorization: Bearer … header. Meta checks two things: is the token valid, and does it carry the permission the call needs?
- whatsapp_business_messaging lets the app send and receive messages.
- whatsapp_business_management lets it manage templates, phone numbers and account settings.
- business_management is sometimes needed to work with the business portfolio itself.
How to get a WhatsApp access token
The token on the App Dashboard's WhatsApp → API Setup page is a temporary test token that expires quickly. For a token that keeps working, generate one for a system user:
- In Meta Business settings, open System users and add one (for example whatsapp-server).
- Click Assign assets: give it your Meta app and your WhatsApp Business account with full control.
- Click Generate token, pick the app, set the expiry to never, and tick whatsapp_business_messaging, whatsapp_business_management and business_management.
- Copy the token at once and store it on your server only.
- Test it by sending one approved template to your own number.
A token alone is not enough. Every integration needs these values together:
| Value | Where to find it | Used for |
|---|---|---|
| Access token | Generated in step 3 | The Authorization: Bearer header |
| Phone number ID | App Dashboard → WhatsApp → API Setup | Sending messages: /{phone-number-id}/messages |
| WhatsApp Business account ID | The same API Setup panel | Templates and number lists: /{waba-id}/… |
The full walkthrough, with every click in Business settings, a curl test and fixes for errors 190 and 200 is in our guide to generating a permanent WhatsApp access token.
Why a system user, not a person
A token tied to a person's Facebook login breaks when that person changes their password, loses access or leaves the company. A system user is a service account created inside the business portfolio. An admin gives it access to the WhatsApp Business account and the app, then generates a token for it. That token keeps working regardless of who joins or leaves the team.
Example: the agency handover
Priya's agency built an appointment-reminder integration for Sunrise Clinic using a token generated from her own login. When Priya moved to another client, her access to the clinic's portfolio was removed and every reminder failed the next morning with an authentication error. The fix was to create a system user in the clinic's portfolio, assign it the WhatsApp account, generate a new token and update the integration. The clinic now controls the token, and staff changes no longer break sending.
Keeping the token safe
Anyone holding the token can send messages as your business and spend your balance. Store it only on the server, never in a website's JavaScript, a mobile app, a spreadsheet or a support chat. If it is exposed, revoke it from the business portfolio settings and generate a new one at once.
Access tokens in Broadchat
When you connect a number through Embedded Signup, Broadchat handles Meta's token for you; you never paste one. For developers, each channel under Channels → All Channels has its own channel access token and a Graph-compatible proxy at /api/meta/{version}/{phone-id or waba-id}/…, so existing Cloud API code can call Broadchat with a Broadchat token instead of a Meta token. Template sends made this way are billed to the channel wallet. Background on the platform is in what the WhatsApp Business API is.
Sources
- Access tokens for the WhatsApp Business Platform — Meta for Developers, checked 12 October 2026
- WhatsApp Business Platform documentation — Meta for Developers, checked 12 October 2026
Broadchat team · Product and partner success team
The people who build and support Broadchat, the white-label WhatsApp Business API platform. We write from what we see while onboarding partners and their clients on the official WhatsApp Cloud API, and we check every article against Meta's current documentation.
Last updated:
Frequently asked questions
How do I get a WhatsApp business access token and the business account ID?
Create a system user in Meta Business settings, assign it your app and WhatsApp Business account, then generate a token with the WhatsApp permissions. Copy the phone number ID and WhatsApp Business account ID from the App Dashboard's WhatsApp API Setup page and store all three together on your server.
Do temporary tokens from the developer dashboard work in production?
They are meant for testing and expire quickly. Production integrations should use a token generated for a system user in the business portfolio.
Is the Broadchat channel token the same as Meta's token?
No. The channel token authorises calls to Broadchat's proxy for that one channel. Broadchat then makes the matching call to Meta on the server side. Treat the channel token as a secret all the same, because it can send messages billed to that channel's wallet.
What should I do if a token was shared by mistake?
Revoke it immediately and generate a new one, then update every system that used the old token. Check recent message activity and wallet usage for anything you did not send.