You can configure Embedded Signup so that only business tokens can be used to access assets owned by customers onboarded via the flow. This approach offers enhanced security by reducing risk associated with system tokens, flexibility in simplifying onboarding for other Meta assets, and scalability to support a larger number of onboardings. By using a granular token, you can also reduce the negative impact in case of a compromised token, making it a more secure and efficient way to manage your business customer assets.

Note that App-Only Install can’t be used to onboard WhatsApp Business app users.

To enable this feature, set features to app_only_install in the Embedded Signup configuration.

{
  "config_id": "<CONFIGURATION_ID>",
  "response_type": "code",
  "override_default_response_type": true,
  "extras": {
    "version": "v3",
    "features": [
      {
        "name": "app_only_install"
      }
    ]
  }
}

To enable this feature along with a Multi-Partner Solution:

{
  "config_id": "<CONFIG_ID>",
  "response_type": "code",
  "override_default_response_type": true,
  "extras": {
    "version": "v3",
    "features": [
      {
        "name": "app_only_install"
      }
    ],
    "setup": {
      "solutionID": "<SOLUTION_ID>"
    }
  }
}

When a business customer successfully completes the flow, the session logging message event will have event set to FINISH_GRANT_ONLY_API_ACCESS:

{
  data: {
    phone_number_id: "<CUSTOMER_BUSINESS_PHONE_NUMBER_ID>",
    waba_id: "<CUSTOMER_WABA_ID>",
    business_id: "<CUSTOMER_BUSINESS_ID>",
  },
  type: "WA_EMBEDDED_SIGNUP",
  event: "FINISH_GRANT_ONLY_API_ACCESS",
}

When a business customer successfully completes the flow, an account_update webhook is triggered with event set to PARTNER_APP_INSTALLED.

{
  "entry": [
    {
      "id": "<PARTNER_BUSINESS_ID_1>",
      "time": "<WEBHOOK_TRIGGER_TIMESTAMP>",
      "changes": [
        {
          "value": {
            "event": "PARTNER_APP_INSTALLED",
            "waba_info": {
              "waba_id": "<WABA_ID>",
              "owner_business_id": "<WABA_OWNER_BUSINESS_ID>",
              "partner_app_id": "<APP_ID>",
              "solution_id": "<SOLUTION_ID>",
              "solution_partner_business_ids": [
                "<PARTNER_BUSINESS_ID_1>",
                "<PARTNER_BUSINESS_ID_2>"
              ]
            }
          }
        }
      ],
      "field": "account_update",
      "object": "whatsapp_business_account"
    }
  ]
}

If an onboarded business customer uses Meta Business Suite⁠ to uninstall/remove the app, an account_update webhook is triggered with event set to PARTNER_APP_UNINSTALLED.

{
  "entry": [
    {
      "id": "<PARTNER_BUSINESS_ID>",
      "time": "<WEBHOOK_TRIGGER_TIMESTAMP>",
      "changes": [
        {
          "value": {
            "event": "PARTNER_APP_UNINSTALLED"
          },
          "field": "account_update"
        }
      ]
    }
  ],
  "object": "whatsapp_business_account"
}

You can use the Business Token Management API to get an onboarded business customer’s business token.

curl -i -X POST "https://graph.facebook.com/v22.0/<CUSTOMER_BUSINESS_PORTFOLIO_ID>/system_user_access_tokens
  ?appsecret_proof=<APPSECRET_PROOF_HASH>
  &access_token=<ACCESS_TOKEN>
  &system_user_id=<SYSTEM_USER_ID>
  &fetch_only=true"

Did you find this page helpful?

App-Only Install

Enabling the feature in Embedded Signup v3