Embedded Signup FAQ

A business owns their own WhatsApp Business Account (WABA) and will see it in their Business Manager. Access to that WABA will automatically be shared with the Solution Partner, through whose website they signed up, upon completion of the Embedded Signup flow. The business does not have to take any action to add the Solution Partner to the WABA.

See Businesses Own Their WABAs.

When a business shares a WhatsApp Business Account with a Solution Partner, the Solution Partner will receive both a Business Manager notification and an email. See Manage Accounts, Sharing Notification.

At this time, a business can only share access to their WhatsApp Business Account with one party: the Business Solution Provider. We will explore options for them to share access with more parties in the future.

Admin System users do not need to be explicitly added to a WABA as they automatically have access to all assets.

The recommended approach is using employee-access system users, and these are the users that need to be added to every WABA that is created, as they do not have access by default. This recommendation is purely based on potential security risks. Since system user access tokens are valid for a very long period of time, a leak of the token could invite potential security breach, especially if that account has Admin permissions for the entire business account. That said, if you choose to keep an Admin System User, you do not need to add it to the WABA.

No. At this time businesses can’t restrict access as they own the WhatsApp Business Account and can view it in their WhatsApp Manager.

Once the Embedded Signup flow is complete and all the business profile information is captured, the certificate will be available for download.

Beginning May 2, 2022, after signup, a compliance check with the WhatsApp platform policies is auto-triggered and performed in the background. If this check fails, we notify businesses via email and the account is disabled. Businesses have the ability to appeal.

Businesses must initiate Business Verification (BV) when they are ready to scale business-initiated conversations, add additional phone numbers, or request to become an Official Business Account (OBA).

When a business hits their limits, they are directed through in-product guidance on how to upgrade by initiating BV. There is no change to the current processes for BV or OBA. Once approved, businesses can send business-initiated conversations to 1K unique customers and increase based on our messaging limits upgrade requirements.

Beginning May 2, 2022, the display name review is initiated after Business Verification (BV) is completed. The display name can be updated at any time. Any updates to the display name post BV have to go through a review again. For more details, visit Display name documentation.

No changes are being made to other checks at this time.

Solution Partners can download certificates as soon as a business has signed up. At this time, you should also start up the WhatsApp Business API client, so that the business can send messages while in an unverified state.

Certificates can be downloaded for phone numbers in trial experience and for phone numbers that have completed all reviews (Business Verification, WhatsApp checks, an display name review). To download a certificate, use the phone_numbers endpoint or the WhatsApp Manager. Only the Solution Partners can download certificates —businesses are not allowed to do this.

If a business does not pass our checks, we disconnect their number. We notify the Solution Partner and the business via both email and Business Manager notifications. At that point, WhatsApp turns off the phone number and the Solution Partner must shut down the WhatApp Business API client instance for that business.

Some Business Manager accounts have already been verified for other reasons. If a Business Manager is already verified, they still need to pass our other checks (display name, commerce policy, etc.) before they can send a high number of messages. Until those checks are completed, they still have access to the unverified trial experience.

If a business wants to use a Business Manager account that is already verified, but they are not an Admin on that Business Manager account, they can try the following:

• Request to be added as an admin to the Business Manager account.
• Ask the admin on the Business Manager account to go through the embedded signup flow.
• Instead, create a new Business Manager account and go through Business Verification using that account.

For information on how to request and acquire permission, see App Review.

App Review consists of two parts:

1. App Verification — Evaluation of whether the app works, follows the use case described and meets bar for quality of user experience
2. Permissions Review — Evaluation of whether the developer has only requested permissions they need

You do not need to include the business_management permission in your App Review submission.

Although the credit sharing endpoints require the business_management permission, anyone with an admin role on the business that owns your app can grant your app this permission when setting up a system user access token.

The whatsapp_business_management permission is needed by Solution Partner to manage phone numbers and message templates, send messages, and assign users to the WhatsApp Business Account.

Show clear evidence of how your application uses the whatsapp_business_management and whatsapp_business_messaging permissions. You must include a screen recording of your Embedded Signup integration, and support the use case via detailed developer notes.

Follow the screen recording guidelines to upload videos and screenshots of your integration, what happens after the integration is complete, and how users are able to send messages and receive messages.

Business apps are automatically approved for Standard Access for all Permissions and Features available to the Business app type. This will allow you to grab a screen recording to showcase an allowable use case for each permission requested. See the Access Levels documentation for more information.

Business pay for WhatsApp Business Platform access in several ways:

• Businesses that onboard using a Solution Partner's implementation of Embedded Signup pay the Solution Provider (who shares its credit line with the onboarded business), and the Solution Partner receives an aggregated invoice from Meta.
• Businesses that onboard using a Tech Provider's implementation of Embedded Signup pay Meta directly, or a Solution Partner, if the Tech Provider is partnered with one.
• Businesses that onboard directly to the WhatsApp Business Platform, without the aid of a Solution Partner or a Tech Provider, pay Meta directly.

A Solution Partner can revoke access to their line of credit for individual businesses within the Meta Business Manager or with a series of API calls.

The Solution Partner as the credit line owner is the "Bill To Party" for all businesses sharing the Solution Partner's credit line. The Solution Partner is liable for and will pay Meta for all WhatsApp Business API spend made by these businesses.

The embedded signup flow only works in web browsers and does not work on mobile devices or mobile browsers. Ensure that your clients know to sign up on the web.

Facebook Login integration code is written in vanilla JavaScript, is agnostic to any front-end library, and works with any JavaScript framework of your choice.

Solution Partners and Tech Providers can implement and surface Embedded Signup. See:

• Become a Tech Provider
• Become a Solution Provider

A business should sign up with the phone number and display name they want to use with the WhatsApp Business Platform. We strongly discourage signing up with a test or personal phone number or test display name as they will be difficult to change afterwards.

A business cannot sign up with a phone number that has already been registered for use with WhatsApp Messenger or the WhatsApp Business App.

Businesses cannot currently sign up with IVR numbers through the flow as they will not be able to verify their phone number.

A phone number goes live as soon as the Solution Partner registers the number. If registration is successful, the number goes live within minutes.

Once the original display name has been reviewed, a business can change their display name in the Business Manager. Then, they have to go through display name review once again.

The Solution Partner is notified via email and Business Manager notification once the new name is approved, at which point they have to redownload the certificate and reprovision the WhatsApp Business API client. Solution Partners can also set up webhooks to track these name changes.

Currently, businesses are not able to access direct support. We are evaluating our long-term plans for direct support and will share updates as we have them.

When a business successfully finishes the embedded signup flow, a Facebook Login callback is sent. The Solution Partner can then query for newly shared WhatsApp business accounts and download the certificate.

For Solution Partner

When a business successfully finishes the Embedded Signup flow, a Facebook Login callback is sent. The Solution Partner can query for newly shared WhatsApp Business Accounts accounts and download the certificate. The business's WhatsApp Business Account is also be shared with the Solution Partner.

Solution Partner should also support businesses through the process of business verification, ensuring they understand the process and are able to provide the right documentation.

For Businesses

Once the signup flow is complete and all the business profile information is captured, the certificate will be available for download. Businesses can respond to unlimited customer-initiated conversations (24-hour messaging windows) and send business-initiated conversations to 50 unique customers in a rolling 24-hour period.

Businesses should initiate business verification when they are ready to scale business-initiated conversations, add additional phone numbers, or request to become an Official Business Account.

Verify that a valid payment method is attached to the WhatsApp Business Account. If there isn’t a payment method then message template sends will fail.

Verify that your Facebook app has business_management and whatsapp_business_management permissions. If this does not resolve the issue, open a direct support ticket and provide app info and the steps for support to reproduce the issue.

While in the Embedded Signup flow, the user can only select or create a single WhatsApp Business Account at a time. However, we do support the user going through the flow again and creating or selecting another WhatsApp Business Account.

Please remember that the main change with the Embedded Signup flow is that the client will own both the Business Manager and the WhatsApp Business Account and share them with the Solution Partner.

The embedded signup flow is available in 30 languages. The localized flow is automatically triggered based on the language that the end client uses Facebook in. See Overview, Translations for more information.

No, the flow is standardized across all Solution Partners, so all businesses signing up have the same experience. Solution Partners have control of the experience before and after the embedded signup flow, including next steps, where to route businesses, etc.

Once the business finishes the embedded signup oAuth flow registration, the JavaScript callback will get the accessToken that can be used with Debug-Token endpoint to fetch the shared WhatsApp business accounts.

The client_whatsapp_business_accounts endpoint can also be used to retrieve a list of all shared WhatsApp Business Accounts.

When using the Debug-Token endpoint, you will get the exact list of WhatsApp Business Accounts the business has shared with you. You can always match these IDs with any existing IDs on your side to sift through duplicates.

The target_ids returned from the Debug-Token endpoint are the IDs of the WhatsApp Business Accounts the business has shared with you through the embedded signup flow.

The client_whatsapp_business_accounts endpoint returns all client-owned WhatsApp Business Accounts that are shared with the Solution Partner.

If two WhatsApp business accounts were created at the same time through the embedded signup flow, the API response captures both WhatsApp Business Accounts.

In order to detect new phone numbers added to a WhatsApp Business Account, we'd recommend using the phone_numbers endpoint. It returns all client-owned WhatsApp Business Accounts that have been assigned to the Solution Partner, regardless of whether it is new or has a phone number set up yet.

Clients can create multiple WhatsApp Business Accounts under the same business ID. Client’s business information can be fetched with the WhatsApp Business Account endpoint.

Example request

curl -i -X GET "https://graph.facebook.com/v21.0/{business-id}/
  owned_whatsapp_business_accounts?
  access_token=system-user-access-token"

Example response

{ 
    "data": [
        {
            "id": 1906385232711451, 
            "name": "My WhatsApp Business Account", 
            "currency": "USD", 
            "timezone_id": "1", 
            "message_template_namespace": "abcdefghijk_12lmnop" 
        },
       {
            "id": 1972385232711141, 
            "name": "My Regional Account", 
            "currency": "INR", 
            "timezone_id": "5", 
            "message_template_namespace": "12abcdefghijk_34lmnop" 
        },

    ],
    "paging": {
	"cursors": {
		"before": "abcdefghij"
		"after": "klmnopqr"
	}
   }
}

The client can go through the embedded signup flow again, select an existing WhatsApp Business Account and add a new phone number. To detect this change, you can query the phone_numbers endpoint for all client WhatsApp Business Accounts to note a newly added phone number.

You can filter WhatsApp Business Accounts by creation time or sort WhatsApp Business Accounts by creation time.

You can filter and sort WhatsApp Business Accounts by creation time.

At this time, sharing WhatsApp Business Accounts is disabled outside the embedded signup flow.

Businesses using phone numbers that are already registered to WhatsApp Messenger or the WhatsApp Business App can’t use these numbers for embedded signup. If their number is currently being used for the Business App then they need to delete it.

The instructions on how to delete the number and then request the number for WhatsApp embedded signup are located at Migrate Phone Number.

If the account has not yet been verified, the number is eligible for an unverified trial experience for 30 days. During this time, the number can be registered and used to reach a limited number of users. Once the account and phone number display name are verified, the phone number is available for regular usage.

If the account is not verified in 30 days, the unverified trial experience expires and the number is disconnected. When this occurs, businesses need to get the account verified to re-register the number.

Businesses can add additional phone numbers to their WhatsApp Business Account by accessing their Facebook Business Account and adding additional numbers.

Embedded signup doesn't currently support retrieving the Phone Number node. You can retrieve the phone number and certificate data by calling the phone_numbers edge on a WhatsApp Business Account node using the following:

https://graph.facebook.com/v21.0/{{WABA-ID}}/phone_numbers?fields=display_phone_number,name_status,certificate,new_certificate,new_name_status

For more information, see WhatsApp Business Account Management, Registration.

• Standard Graph API rate limits and Business Use Case Rate Limits apply.
• Multiple system users count as a single user.
• Using the user access token returned from the oAuth flow will increase your user count and subsequently your rate limits.

• User Access Token — A short lived token returned from the oAuth flow, which can be used to fetch the list of WhatsApp Business Accounts shared with you. See the Access Token documentation for more information.
• System User Token — System users represent servers or software making API calls to assets owned or managed by your Business Manager account. System User tokens are long-lived tokens that don't have an expiry time. These tokens are still subject to invalidation for other reasons but won't expire solely based on time period. If you generate a new System User token, any old tokens will still be valid and have the same permissions as the new token unless revoked. Once you add your System User to the WhatsApp Business Account, you will be able to make API calls to manage that account in future.

The specified system user doesn't have permissions to update the WhatsApp Business Account (WABA). Verify that the specified system user has WABA access. If not, the specified system user needs to be added to the WABA.