Create a Production System-User Access Token
Create a restricted Meta system user, assign the correct assets and generate a long-running WhatsApp API token for Wemblo.
Overview
Search Aliases: permanent WhatsApp token, non-expiring token, WABA system user, WhatsApp API secret
IMPORTANT TERMINOLOGY
| Temporary Access Token | Short-lived credential for initial testing. |
|---|---|
| System User | Non-person identity controlled by the business. |
| Long-Running Token | Token created for ongoing server use; it can still be revoked, invalidated or affected by permission/account changes. |
| Asset Assignment | Gives the system user access to the app and WhatsApp assets. |
| Scope / Permission | Defines the API actions the token can perform. |
PROVIDER-SIDE STEPS
- Open Meta Business Settings.
- Select the correct Business Portfolio.
- Open Users -> System Users.
- Choose Add.
- Enter a clear internal name such as Wemblo_WhatsApp_Service.
- Choose the minimum role that can manage the required assets; use full administrative access only when genuinely required.
- Create the system user.
- Select the system user.
- Choose Assign Assets.
- Assign the correct Meta app.
- Assign the correct WhatsApp Business Account and phone assets where available.
- Grant only the required management or messaging access.
- Choose Generate New Token.
- Select the correct Meta app.
- Select required permissions such as whatsapp_business_messaging and whatsapp_business_management when required by the intended operations.
- Generate the token.
- Copy it immediately and store it securely.
- Enter it only in the protected Wemblo token field.
SECURITY & ROTATION
- Never place the token in client-side code.
- Do not store it in a public repository or spreadsheet.
- Record the business owner and purpose.
- Use separate test and production credentials where practical.
- Rotate after exposure, staff/vendor change or suspected misuse.
- Revoke the old token after the new token is tested.
- Review Meta system-user activity and asset assignments periodically.
TEST & VERIFICATION
- Save the token in Wemblo.
- Use the test-connection action if available.
- Send an outbound test message.
- Confirm the provider accepts the request.
- Confirm inbound events still work.
- Confirm a user without integration permission cannot view or change the token.
COMMON ISSUES & SOLUTIONS
| Generate Token button missing | Check system-user role and app assignment. |
|---|---|
| Permission not available | Confirm the app, product and Business Portfolio relationship. |
| Token works for one asset only | Review WABA and phone asset assignment. |
| Token stops working | Check revocation, business/app changes and permission removal. |
| Unauthorized error | Confirm the token, selected app and required permission. |
Last reviewed:

