WhatsApp Business API · Admin

Where do I find each value? Setup walkthrough

Meta scatters these values across three consoles: developers.facebook.com/apps (the App), business.facebook.com/wa/manage (WhatsApp Manager), and business.facebook.com/settings/system-users (Business Settings). Follow the six steps below in order.

App ID + App Secret Required
Meta App Dashboard → select your app → App settings → Basic. Copy App ID (public) and click Show next to App Secret (you may be re-prompted for your Facebook password). Paste both into the fields below.
Open Meta App Dashboard →
WABA ID (WhatsApp Business Account ID) Required
WhatsApp Manager → the small settings gear at the top-right of the account name shows the numeric ID. Or, in the App Dashboard, WhatsApp → API Setup displays it under “WhatsApp Business Account ID”.
Open WhatsApp Manager →
Phone Number ID Required
App Dashboard → WhatsApp → API Setup → the “From” dropdown lists every number added to this WABA and displays its Phone Number ID (a long numeric string; NOT the phone number itself). If your production number isn’t listed, add it in WhatsApp Manager → Phone numbers → Add phone number.
Access Token — use a System User token, not the temporary one Required
The token shown in WhatsApp → API Setup expires in 24 hours — fine for a first “hello world”, useless in production. For real deployment, mint a non-expiring System User token:
1. Business Settings → Users → System users → Add. Give it a name (e.g. “codeb-wa-bridge”) and role Admin.
2. Click the new system user → Add assets → add the WhatsApp Account with Full control.
3. Click Generate new token → pick your Meta App → expiration Never → permissions whatsapp_business_messaging + whatsapp_business_management.
4. Copy the token immediately (Meta shows it once) and paste into the field below.
Open Business Settings → System users →
Sender phone + display name Cosmetic
Copy the actual number in E.164 format (e.g. +4915157610183) from WhatsApp Manager → Phone numbers. The display name is what your chat UI shows above each thread — a short label like “WhatsApp” or “Guest inbox”.
Callback URL + Verify Token — auto-generated below Paste into Meta
After you save the config below, scroll down to Meta Dashboard values. Copy the Callback URL and Verify Token and paste them into Meta App Dashboard → WhatsApp → Configuration → Webhook → Edit. Meta verifies immediately by hitting our /whatsapp.ashx?action=webhook with hub.mode=subscribe; on success the panel turns green. Then subscribe to the fields listed lower down on this page (messages is the essential one).

Order matters. Fill and save steps 1–5 before pasting the Callback URL into Meta — the webhook handshake fails if the App ID hasn’t been saved on our side yet (we look it up per tenant to verify the X-Hub-Signature-256 header).

Tenant configuration

Values from App_Data/<tenant>/chat-whatsapp/config.json. Secrets are masked on load and only sent when the field is edited.

App ID

App Secret

WABA ID

Phone Number ID

Access Token

Sender phone (E.164)

Sender display name

Enabled

Team-chat routing & email forwarding

Which internal users should see incoming WhatsApp messages in their team chat, and which email addresses receive an extra copy of each inbound message.

Routing users

Loading tenant users…

Checked users see incoming WhatsApp conversations in /chat.html. Each remote WhatsApp number gets its own group (gc-wa-<E.164 digits>) auto-created on first inbound message. Each checked user's email address (from their tenant profile) also receives a copy of every inbound message automatically — no need to list them below.

Extra forwarding emails (comma-separated, in addition to routing users) Optional. For emails outside the tenant's user directory (shared inboxes, alerts, ticketing systems). Every inbound WhatsApp message is copied as plain text to each address here plus to each routing user's stored email. De-duplicated automatically. Uses IIS SMTP pickup (fire-and-forget).

Meta Dashboard values

Paste these into your Meta App at developers.facebook.com/apps under WhatsApp → Configuration.

Callback URL: -
Verify Token: -
Webhook path: /whatsapp-webhook (cleaner alias → internally rewrites to /whatsapp.ashx?action=webhook)

Rotate the App Secret in the Meta Dashboard once initial setup works — if any Secret has been sent through a chat/support channel, treat it as leaked.

Real inbound needs a published app

While your Meta App is in unpublished / Development mode, Meta will not forward real WhatsApp messages to this webhook — only synthetic events fired from the Meta Dashboard’s Send test webhook button. To receive real customer messages, you need to complete App Review and publish the app (which in turn requires Business Verification). Outbound send is not affected — it works pre-publish as long as the recipient is on the allowed-tester list.

Webhook subscriptions

In the Meta App Dashboard → WhatsApp → Configuration → Webhooks, subscribe to these WhatsApp Business Account fields. Only messages is required for the chat bridge; the rest are recommended so operational events (template approvals, quality drops, account alerts) land in the audit log.

Field	Purpose	Priority	Our handling

Tip. A successful subscription requires the callback URL and verify token to match on both sides. Meta’s dashboard verifies immediately by sending a GET to our webhook with hub.mode=subscribe. If it fails, check the Verify Token above matches character-for-character what you paste in the Meta Dashboard.

Test send

Sends a text message via POST /whatsapp.ashx?action=send. Requires Phone Number ID and Access Token to be filled in.

To (E.164)

Body

API keys — external send

Server-to-server outbound: an external system authenticates with a mint-once API key and POSTs to /whatsapp.ashx?action=send-external to send WhatsApp messages through this tenant's number. Keys are shown in plaintext only at creation — save it into your integration then.

Label (human-readable)

Bind to template (optional)

Bind a key to a specific template to drastically shrink the blast radius if the key ever leaks. A bound key can ONLY send that Meta-approved template; free-form text and other templates are refused with 403 template-required or 403 template-mismatch. Leave unset to mint an unrestricted key.

Usage — POST /whatsapp.ashx?action=send-external

Loading…

Header: X-CodeB-WhatsApp-API-Key: <plaintext-key>. Body: {to, body} for free-form (open 24-h window only) OR {to, template:{name,language,components}} for template send. to is E.164 (with or without leading +). Response mirrors Meta Graph API delivery status and echoes channel + keyId for correlation. Any auth failure — missing/wrong/revoked key, tenant not configured — returns a uniform 401 unauthorized.

Message templates

Meta-approved templates are the only way to reach a WhatsApp user OUTSIDE the 24-hour customer service window. Submit here, Meta reviews within minutes-to-hours (Utility & Authentication faster than Marketing). Approved templates appear in chat.html's new-conversation picker automatically.

Loading…

Submit a new template

Name (snake_case, [a-z0-9_])

New-chat quota — abuse guard

Caps distinct outbound recipients per calendar day (UTC). Applies uniformly to the WhatsApp API, the external send endpoint, and the in-app new-chat button. Replies to same-day recipients don't consume quota. Set to 0 for unlimited (not recommended when API keys exist).

Daily limit

Loading…

Recent activity (last 60 events)

From the tenant audit log at chat-whatsapp/audit/*.jsonl. Inbound = webhook events from Meta. Outbound = replies you sent.

Loading…

WhatsApp Business API -

Admin sign-in required

Where do I find each value? Setup walkthrough

Tenant configuration

Team-chat routing & email forwarding

Meta Dashboard values

Real inbound needs a published app

Webhook subscriptions

Test send

API keys — external send

Message templates

New-chat quota — abuse guard

Recent activity (last 60 events)