Create a Production System-User Access Token

Create a restricted Meta system user, assign the correct assets and generate a long-running WhatsApp API token for Wemblo.

Overview

Search Aliases: permanent WhatsApp token, non-expiring token, WABA system user, WhatsApp API secret

IMPORTANT TERMINOLOGY

Temporary Access TokenShort-lived credential for initial testing.
System UserNon-person identity controlled by the business.
Long-Running TokenToken created for ongoing server use; it can still be revoked, invalidated or affected by permission/account changes.
Asset AssignmentGives the system user access to the app and WhatsApp assets.
Scope / PermissionDefines the API actions the token can perform.

PROVIDER-SIDE STEPS

  1. Open Meta Business Settings.
  2. Select the correct Business Portfolio.
  3. Open Users -> System Users.
  4. Choose Add.
  5. Enter a clear internal name such as Wemblo_WhatsApp_Service.
  6. Choose the minimum role that can manage the required assets; use full administrative access only when genuinely required.
  7. Create the system user.
  8. Select the system user.
  9. Choose Assign Assets.
  10. Assign the correct Meta app.
  11. Assign the correct WhatsApp Business Account and phone assets where available.
  12. Grant only the required management or messaging access.
  13. Choose Generate New Token.
  14. Select the correct Meta app.
  15. Select required permissions such as whatsapp_business_messaging and whatsapp_business_management when required by the intended operations.
  16. Generate the token.
  17. Copy it immediately and store it securely.
  18. Enter it only in the protected Wemblo token field.

SECURITY & ROTATION

  • Never place the token in client-side code.
  • Do not store it in a public repository or spreadsheet.
  • Record the business owner and purpose.
  • Use separate test and production credentials where practical.
  • Rotate after exposure, staff/vendor change or suspected misuse.
  • Revoke the old token after the new token is tested.
  • Review Meta system-user activity and asset assignments periodically.

TEST & VERIFICATION

  1. Save the token in Wemblo.
  2. Use the test-connection action if available.
  3. Send an outbound test message.
  4. Confirm the provider accepts the request.
  5. Confirm inbound events still work.
  6. Confirm a user without integration permission cannot view or change the token.

COMMON ISSUES & SOLUTIONS

Generate Token button missingCheck system-user role and app assignment.
Permission not availableConfirm the app, product and Business Portfolio relationship.
Token works for one asset onlyReview WABA and phone asset assignment.
Token stops workingCheck revocation, business/app changes and permission removal.
Unauthorized errorConfirm the token, selected app and required permission.

Last reviewed: