WAPI Connect Pro
العربيةSee pricing
Menu
العربيةSee pricing
Documentation

Create a permanent access token

About 10 minutes · Last checked 31 October 2026 · Plugin 2.10.0

The token is the key your store uses to send messages through your Meta app. At the end of this guide the plugin has a token that keeps working, plus your Phone Number ID and WhatsApp Business Account ID, and Connection Doctor shows your number.

Why not the token on API Setup?

The token on your app’s API Setup page is temporary: it stops working after 24 hours. A System User is an account in your business portfolio that belongs to the business, not to a person. Its token can be set to never expire, and it keeps working when someone leaves your team or changes their Facebook password.

What you need

  • Full control (admin access) of your business portfolio.
  • Your Meta app, connected to that portfolio (create your Meta app).
  • Your WhatsApp Business account with your number (your phone number).
Meta’s screens change

Names below are from Meta’s English screens on 17 October 2026. If one differs on your screen, look for the closest button.

Steps

  1. Open your Business settings

    Go to business.facebook.com/settings and make sure your store’s business portfolio is selected at the top. In the menu open “Users” → “System users”.

  2. Add a system user

    Press “Add”, type a name you will recognise (for example store-whatsapp), choose the role Admin and press “Create system user”.

  3. Give it your app and your WhatsApp account

    Select the new system user and press “Assign assets” (it may say “Add assets”). Give it two assets, each with full control:

    • under “Apps”: your Meta app
    • under “WhatsApp accounts”: your WhatsApp Business account

    Save the changes. Without both assets, the token cannot see your number.

  4. Generate the token

    With the system user selected, press “Generate new token”. Choose your app, set the token expiration to “Never” and tick these three permissions:

    • business_management
    • whatsapp_business_management
    • whatsapp_business_messaging

    Press “Generate token” and copy it right away: Meta shows it only once. Keep it somewhere safe, such as a password manager.

  5. Paste your details into the plugin

    In WordPress open WAPI Connect → Settings → WhatsApp API and fill in:

    • Phone Number ID: from your app’s API Setup page, under your number. It is not your phone number.
    • WhatsApp Business Account ID: on the same page. The plugin needs it to list your approved templates and to check the connection.
    • Permanent Access Token: the token from step 4. If a token is already saved, tick “Replace with a new token” first, then paste.

    Leave “Graph API Version” as it is. “Meta App ID (optional — template media)” can stay empty: the plugin usually finds it by itself, and only pictures, videos and files in templates need it. “Webhook Verify Token” and “App Secret” come in the webhook guide. Press “Save Settings”.

    Four fields with their help lines: Phone Number ID, a long number from WhatsApp → API Setup that is not your phone number; WhatsApp Business Account ID, also on the API Setup page; Permanent Access Token, set, with a box to replace it and a note to use a System User token; Webhook Verify Token, any secret word, with the Callback URL of the store below it
    WAPI Connect → Settings → WhatsApp API: the three fields of this step, each with where its value comes from. A saved token stays hidden, so tick “Replace with a new token” to paste another one. The Webhook Verify Token at the bottom comes in the webhook guide. The values are blurred here. Demo store data.

    If you have not done it yet, open the General tab, tick “Enable Plugin” and press “Save Settings”. Order messages and cart reminders stay off until you turn them on.

Check that it worked

  • WAPI Connect → Health & tools → Connection Doctor: the “WhatsApp number” card is green and shows your number and the name Meta verified.
  • Health & tools → Test tools → “Test connection” answers with your number and its quality.
  • Connection Doctor also shows “Templates can be managed”: the token can read and create your message templates.
  • The token field now shows “Token is set:” with a masked value. The plugin keeps the token in your database and never shows it in full.

Keep the token safe

  • Anyone with the token can send messages from your number. Never send it by e-mail or chat, and never paste it into a page or a public file.
  • If it leaks, open the system user in Business settings, revoke its tokens, generate a new one and paste it with “Replace with a new token”.
  • Removing the system user, or its access to your app or WhatsApp account, stops the token too.

Common problems

Connection Doctor says “WhatsApp rejected the connection”

If the card adds “The access token is expired or wrong”, the plugin still has the 24-hour token, or the token was revoked. Generate a System User token as above and paste it with “Replace with a new token”. With any other message from Meta, check that the Phone Number ID is right and that the token was made in the same business portfolio as the number.

Messages fail with “No permission” (error 131005, 10 or 200)

The token is missing a permission or an asset. Check that the system user has both your app and your WhatsApp account, then generate a new token with all three permissions and paste it.

Connection Doctor says “Could not check the webhook subscription”

The WhatsApp Business Account ID is wrong, or the token has no whatsapp_business_management permission. Copy the ID again from API Setup and check the permissions.

The WhatsApp permissions are not in the list

The app you chose does not have the use case for WhatsApp, or the system user does not have the app as an asset. Fix step 3, then generate the token again.

I cannot see “System users”

You need full control of the business portfolio. Ask the portfolio’s admin to give you full control, or to create the system user for you.

← Previous: Your phone numberNext: The webhook →