Skip to main content
There are two types of access tokens used to authenticate WhatsApp Cloud API calls: a temporary token for testing and a permanent system-user token for production. Using the wrong one is the most common reason API calls suddenly stop working.

​
Temporary access token

Generated directly in the Meta developer dashboard under WhatsApp → API Setup → “Generate access token”. It works immediately but expires in approximately 24 hours. Use only for testing — never in production.

​
Permanent system-user token

Generated via Meta Business Manager (business.facebook.com):
1

Open System Users

Go to Business Manager → Settings → Users → System Users.
2

Create a system user

Create a system user (Admin access recommended).
3

Generate the token

Click Generate token on that system user, assign the app and required permissions (whatsapp_business_messaging, whatsapp_business_management).
4

Save it immediately

Copy the token and store it securely — Meta only shows it once.
5

Verify it

Paste the token into the Meta Access Token Debugger (developers.facebook.com/tools/debug/accesstoken/) to verify it is valid and check its expiry — a permanent token shows “Never” as expiry.
Use the permanent token in all production API calls.

​
Walkthrough screenshots

Generate temporary access token
System Users in Business Manager
Generate permanent token
Save your token
Token debugger

​
Frequently asked

Almost certainly your temporary access token expired (~24h). Switch to a permanent system-user token for any production use.
Create a system user in Meta Business Manager, generate a token for that system user with the WhatsApp permissions, and use that token in your API calls. It does not expire.
A non-human admin account in Meta Business Manager used to generate permanent tokens for automated systems (bots, integrations). It is not tied to a personal Facebook account, so it won’t expire when someone leaves the team.
Paste it into the Meta Access Token Debugger at developers.facebook.com/tools/debug/accesstoken/ and click Debug. It shows the token’s expiry, permissions, and whether it is still valid.

​
Gotchas & common mistakes

  • Temporary token expires in ~24 hours — the single most common reason integrations break. Always use a system-user token in production.
  • Token is shown only once — when you generate a system-user token, copy it immediately. If you lose it, you must generate a new one.
  • Permissions matter — the system user token needs at minimum whatsapp_business_messaging to send messages. Missing permissions cause authentication errors even with a valid token.
  • Token belongs to the system user, not a person — if you use a personal user token instead, it may stop working if that person’s account changes.