How to Get a WhatsApp API Key (Token), Step by Step

Many business owners who search "how to get a WhatsApp API key" get lost in the developer pages they land on. The short answer: the WhatsApp Cloud API has no "API key" in the classic sense. Instead, you use an access token issued by Meta. Below we explain what this token is, what types exist and how you get the permanent one, without drowning you in technical jargon.

Is a WhatsApp API key the same as an access token?

In practice, yes. People say "API key", Meta's documentation says "access token". Both do the same job: they let your software tell Meta "I am authorized to send messages on behalf of this WhatsApp account".

A token is a long, random-looking string of characters. Your software adds this string to every request it sends to WhatsApp, and Meta uses it to work out who the request comes from and which account it can access. Think of it as a door card. Whoever carries the card gets the door opened for them.

If you are wondering what the WhatsApp Business API is and how it differs from the app, you can first take a look at our What is the WhatsApp Business API article.

What token types are there, and which should you use?

In Meta's access token guide, three types stand out for WhatsApp. Which one you use depends on whether you connect to the API for your own business or on behalf of other businesses.

In short: if you will connect your own software to WhatsApp, what you need is the system user token. This is what people commonly call the "permanent token".

Why is the temporary token not enough?

Every time you open the WhatsApp setup screen in the Meta developer dashboard, you are given a new temporary token. It is perfect for a test message. But Meta's own documentation says plainly that this token expires quickly and is not suitable for development.

What happens if you use it in a live system? One morning your order notifications quietly stop. The token has expired and the software is no longer authorized. This is a scenario we see often.

How do you get a permanent token, step by step?

The steps below are based on Meta's WhatsApp Cloud API getting-started and access token documentation. We wrote the screen names with the English equivalents Meta uses; they may look different in a Turkish interface.

What needs to be ready before you start

• Your Meta business portfolio (a Business Manager account). We explain the verification process in our Meta business verification article.
• A Meta developer account and an app with the WhatsApp use case added.
• A WhatsApp account and phone number linked to this portfolio.
• A user with admin permission on the portfolio. System user settings are opened with this permission.

Steps

1. Create a system user. In Meta Business Suite, go to the Business settings section and click System users in the side menu. Create a new user with the Add button, give it a name and choose its role: Admin or Employee.
2. Assign the app. Select the user you created and click Assign assets. Choose your app and turn on the Manage app permission under Full control.
3. Assign the WhatsApp account. From the same screen, give your WhatsApp account to this user as well.
4. Generate the token. Press the Generate token button. In the window that opens, choose your app and set the token's duration preference.
5. Add the permissions. The three permissions Meta requires are: business_management, whatsapp_business_management and whatsapp_business_messaging. If you type "business" in the search box, you will find them quickly.
6. Copy and store it. When the token appears on screen, copy it right away and save it somewhere safe.

If you want to check that the token was generated with the right permissions, you can paste it into Meta's Access Token Debugger tool. The tool shows the token's type, which app it belongs to, its permissions and its expiry status.

Does a permanent token really never expire?

Not exactly. A system user token can be generated so that it does not expire over time, but Meta also notes that these keys can become invalid for other reasons. If you choose a set duration when generating it (for example 60 days), you need to renew it when that time is up.

Which is better? A non-expiring token is practical, with no risk of forgetting to renew. A token with a set duration keeps the damage limited if it leaks. If your software team can handle renewal automatically, the set-duration option is the more cautious choice.

How do you keep the token safe?

Meta is clear about these keys: treat them like your password. Someone who holds the token can send messages from your number and manage your templates. That is why we suggest these rules:

• Do not put it in your site's code. A token sitting in code that runs in the browser is where anyone can see it. The token should stay on the server side only.
• Do not share it by email or message. If you need to pass it to an agency or developer, use a secure route such as a password manager.
• Do not grant more permission than needed. If your app will access a few accounts, the Employee role instead of Admin may be enough.
• Do not upload it to a code repository. Instead of writing the token into the code, keep it in the secret settings on the server.
• If you suspect a leak, do not wait. Generate a new token, update your software and revoke the old one.

Does a business using a panel have to deal with tokens?

No. All of these steps are for businesses that connect their own software directly to WhatsApp. If you work through a ready-made panel, you do not generate, copy or store tokens.

Chatopya is a Meta-approved Tech Provider. When setting up the WhatsApp Business API, we carry out Meta business verification and the application on the business's behalf. Panel setup takes about 5 minutes; if the number has never been registered with Meta before, Meta's own review time is added. After that, you manage your messages, templates and team directly from the panel.

So what if you want to connect your own ERP or custom software? In Chatopya, API access and ERP/custom integration are offered in the Enterprise plan. You can see the plans on the pricing page.

What are the most common mistakes?

• Going live with a temporary token. Everything works on day one, and stops the next day.
• Generating the token with missing permissions. If one of the three permissions is missing, some operations return errors.
• Skipping account access. If the WhatsApp account and the messaging account have not been assigned to the system user, the token alone does not work.
• Entrusting the token to one person. When that person leaves the company, nobody knows where the key is. The main advantage of a system user is that it is tied to the business, not to one person.

Frequently asked questions