How to generate a permanent WhatsApp Cloud API access token (system user)

A permanent WhatsApp access token is a token generated for a system user in your Meta business portfolio with its expiry set to never. It is what a production server uses to call the WhatsApp Cloud API day after day without anyone logging in. This guide walks through the exact clicks in Business settings, the IDs you need alongside the token, a curl test, and the errors you will see when something is missing. If you only want the concept, read the glossary entry on WhatsApp API access tokens and system users first.

Temporary vs permanent token

Meta gives you three kinds of token. Only one of them belongs on a production server you run for your own business:

The API Setup token is tied to your personal Facebook login. Meta's own guide says user tokens "expire quickly, so you have to keep generating a new one every few hours". A system user is a non-human account owned by the portfolio, so its token keeps working when staff change.

Before you start

Check four things, because each one causes a different error later:

1. Your Facebook login has full control (admin) of the business portfolio.
2. You have a Meta app created with the Connect with customers through WhatsApp use case, owned by the same portfolio.
3. The app is connected to your WhatsApp Business account in the API Setup panel.
4. At least one phone number is registered on the Cloud API, and you have one approved template to test with.

If you have not connected a number yet, the WhatsApp Business API setup guide covers the portfolio, number and display name decisions first.

Step 1: create the system user

1. Open Meta Business Suite, pick your business portfolio and open Settings (Business settings).
2. In the sidebar, under Users, click System users.
3. Click Add. In Create system user, enter a name you will recognise later, for example whatsapp-server-prod.
4. Choose the role: Admin or Employee.

Which role? An admin system user automatically gets full access to every WhatsApp account and Messaging account the portfolio owns or has been shared. An employee system user sees only the accounts you assign to it. For one business with one or two numbers, an employee system user is the tighter choice: if the token leaks, it reaches only what you assigned.

Step 2: assign the app and the WhatsApp account

A token is only as useful as the assets its system user can reach. Select the system user and click Assign assets, then:

• Apps: select your Meta app and turn on Manage app (full control).
• WhatsApp accounts: select your WhatsApp Business account and turn on Manage WhatsApp Business accounts under Full control.
• Click Assign assets to confirm.

Reload the System users page and check that both assets now show as assigned; Meta notes that granting can take a few minutes. Meta is splitting the old WhatsApp Business account into a WhatsApp account and a Messaging account. Its access token guide says an employee system user needs access to both, and that in Meta Business Suite you must assign each one explicitly (under Accounts → WhatsApp accounts and Accounts → Messaging accounts, People tab). If your portfolio already shows a Messaging account, assign it too.

Step 3: generate the token

1. With the system user selected, click Generate token.
2. Choose your app.
3. Choose the token expiry: never, or 60 days.
4. Tick the three permissions below. Typing business in the search box finds them quickly.
5. Click Generate token and copy the value straight into your secret store.

Treat the token as an opaque string. Meta warns that tokens vary in length and their format can change, so store it in a text field with no fixed maximum length and never try to parse it. You can paste it into Meta's Access Token Debugger to confirm its expiry and permissions.

Step 4: copy the phone number ID and WABA ID

Most "access token" searches are really about the set of values an integration needs. Collect them in one place now:

You can also confirm the phone number ID from the API with the token you just made:

curl "https://graph.facebook.com/v26.0/$WABA_ID/phone_numbers" \
  -H "Authorization: Bearer $WA_TOKEN"

Each number in the response has an id (the phone number ID), its display_phone_number and its verified_name. The phone number ID is not the phone number: a URL such as /919876543210/messages fails because no phone number has that ID.

Step 5: test the token with curl

Send one approved template to your own WhatsApp number. Templates work whether or not you have messaged that number recently. If your account still has Meta's sample hello_world template in en_US, use it; otherwise use one of your own approved templates with its exact name and language code.

export WA_TOKEN="paste-the-system-user-token"
export PHONE_NUMBER_ID="123456789012345"

curl -X POST "https://graph.facebook.com/v26.0/$PHONE_NUMBER_ID/messages" \
  -H "Authorization: Bearer $WA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product": "whatsapp",
    "to": "919876543210",
    "type": "template",
    "template": { "name": "hello_world", "language": { "code": "en_US" } }
  }'

A working token returns a messages array with an ID starting wamid., and the message arrives on your phone. Run this from your terminal, not from a browser page: anything that runs in the browser exposes the token to every visitor. The template API tutorial shows the same call with variables and buttons, in Node.js and Python.

Step 6: store, rotate and revoke the token

Anyone holding the token can send messages as your business and create templates in your account. Store it like a database password:

• Keep it in environment variables or a secret manager on the server. Never put it in website JavaScript, a mobile app, a Google Sheet, a Postman collection you share, or a support chat.
• Use a separate system user per system (production server, staging, analytics script), so you can revoke one without stopping the others.
• Log who generated each token and when. A token you cannot trace is one you cannot safely revoke.

Rotating a 60-day token. Meta documents a refresh call on the oauth/access_token endpoint (with fb_exchange_token) that issues a new token valid for another 60 days. The old token keeps working until it expires, so deploy the new one first, then revoke the old one.

Revoking a token. Meta's oauth/revoke endpoint invalidates a system user token immediately, and it cannot be used again. Revoke at once if a token was pasted somewhere public, then generate a replacement, update every system that used it, and check recent message activity and billing for sends you did not make.

Common errors and fixes

Most token problems are one of five codes. Read error.code in the JSON response, not just the HTTP status:

For delivery errors that appear after a successful send, such as 131047 (outside the 24-hour window) or 131026 (undeliverable), see our WhatsApp API error codes cheat-sheet.

If your number is on Broadchat

When you connect a number to Broadchat through Embedded Signup, the platform holds the Meta token for you and you never paste one. Developers who want to call the API from their own code use a Broadchat channel token instead:

1. Open Channels → All Channels.
2. On the channel card, open the ⋮ menu and choose Access Token.
3. The API Details window shows the API URL, API Version, WABA ID, Phone Number ID and Business ID, each with a copy button.
4. Click Generate new token and confirm. The token starts with bc_ and is shown once, so copy it before closing the window.

This channel token works only against your panel's own Graph-compatible API at the API URL (your panel address plus /api/meta) and only for that channel's phone number ID and WABA ID; it is not a Meta token and does not work on graph.facebook.com. Template sends made with it are charged to the channel's messaging wallet. Tokens you generated earlier keep working until you choose Revoke Previously Generated Token in the same menu, which revokes all of them without disconnecting the number. Only account owners can see this window. For the bigger picture of how the platform fits together, read what the WhatsApp Business API is or see the WhatsApp Business API overview.