Connect a chatbot to WhatsApp, correctly.
This guide explains the Meta WhatsApp Cloud API setup used by Friday Technologies. Follow the Meta steps first, then enter the approved connection details in your Friday Technologies workspace.
- A Facebook or managed Meta account registered for Meta for Developers.
- Full control of a Meta Business Portfolio and accurate legal business information.
- A WhatsApp Business Account (WABA) and a business phone number.
- HTTPS website access and an approved webhook endpoint.
- Permission to store App ID, App Secret, Configuration ID, webhook verification secret, WABA ID and phone number ID securely.
Part 1 — Create and prepare the Meta business assets
Register as a Meta developer
Open Meta developer registration and complete the registration prompts. A WhatsApp-enabled device is needed for testing.
Create or select the business portfolio
Open Meta Business Settings. Create a portfolio only if you represent that business and have authority to do so. Ensure your user has full control; an ordinary employee or partial administrator may not be able to create or claim an app.
Complete business verification when Meta requests it
In Business Settings, open Security Center and choose Start verification when available. Use the exact legal name, address, phone number and HTTPS website that match official records. Meta may request documents or a verification method and says review can take up to 14 business days.
Create the WhatsApp app
Open the Meta App Dashboard, choose Create App, select Connect with customers through WhatsApp, select the correct business portfolio, confirm the details and create the app. If Meta shows Business is not allowed to claim App or another business restriction, stop creating portfolios and use Business Support Home to inspect the restriction and request review.
Part 2 — Configure Cloud API and test a message
Connect or create the WhatsApp Business Account
In the app’s WhatsApp Quickstart or API Setup panel, connect an existing WABA or create one. Record the WABA ID and the business phone number ID; they are different identifiers.
Use a temporary token only for testing
Generate an access token in the API Setup panel and send the first test message to an allowed test number. Confirm that the message arrives and reply to open the customer service window. Do not put a temporary token in public code or treat it as a production credential.
Create a system user and permanent token for production
In Business Settings, open Users → System users, create a system user, assign the app and WhatsApp assets with the minimum required permissions, and generate a token. Store it server-side in a secret manager or protected environment configuration. Never paste it into browser JavaScript, screenshots, tickets or public repositories.
Configure the webhook
Your endpoint must use HTTPS. In the Meta app’s WhatsApp Configuration area, enter the website’s callback URL and the same verification secret that is stored in Friday Technologies. Meta verifies the endpoint and then sends POST JSON events such as incoming messages and message statuses. Subscribe to the messages field and return HTTP 200 promptly after safely processing the request.
Use the webhook URL and verification secret shown in your signed-in WhatsApp settings page. Do not copy secrets into this public guide.
Part 3 — Connect a client through Embedded Signup
Create the Embedded Signup configuration
In the app dashboard, open the WhatsApp use case and Embedded Signup Builder. Configure the Cloud API flow and record the resulting Configuration ID. The flow uses Facebook Login for Business so a client can select or create a portfolio and WABA, verify a phone number, and grant the app access.
Request the correct permissions and review access
For Cloud API onboarding, Meta documents whatsapp_business_management for WABA settings and templates and whatsapp_business_messaging for sending and receiving messages. In Live mode, permissions that require advanced access must be approved through Meta App Review before customers can onboard.
Enter credentials in Friday Technologies
Platform app (Embedded Signup, Friday staff): open Admin → AI · Customer bots → Customer bot settings and enter the App ID, App Secret, Configuration ID and webhook verification secret there; they apply to every customer bot. One bot on its own number (Cloud API token): open Bot Studio, choose the bot, then the WhatsApp tab, and paste the Phone Number ID and permanent token. Save only after checking the values; Platform setup has a Test button for each step. The App Secret and access tokens are encrypted or protected server-side and are never displayed publicly.
Run the end-to-end test
Complete Embedded Signup, confirm the client’s WABA and phone number, verify the webhook, send a test WhatsApp message to the connected number, and confirm the selected chatbot receives and answers the webhook event. Also test delivery status, invalid credentials, duplicate webhook events and disconnect/reconnect behavior.
Credentials and responsibilities
| Item | Where it comes from | How it must be handled |
|---|---|---|
| App ID | Meta App Dashboard → Basic settings | May be used as an identifier, but keep configuration server-side where practical. |
| App Secret | Meta App Dashboard → Basic settings | Secret. Never expose in HTML, JavaScript, screenshots or public repositories. |
| Configuration ID | WhatsApp → Embedded Signup Builder | Use for the website onboarding flow; keep it tied to the correct app. |
| WABA ID / phone number ID | WhatsApp API Setup or Embedded Signup result | Store with the selected connection and verify that the phone number belongs to the intended business. |
| Access token | Temporary test token or system user token | Temporary tokens expire; production tokens must be protected server-side and rotated if exposed. |
| Webhook verification secret | Chosen by the website administrator | Must match the value entered in Meta and remain private. |
Troubleshooting
Meta says “Business is not allowed to claim App.”
Open Business Support Home, select the affected portfolio under Account Overview, read the restriction reason and use Request review if offered. Complete any human verification, identity, security or business-verification step. Do not create multiple portfolios to evade a restriction.
The webhook verification fails.
Confirm the callback URL is public HTTPS, the verification secret matches exactly, the endpoint handles Meta’s verification request, and the server returns the expected response without login redirects, PHP warnings or firewall blocks.
Messages send in testing but not in production.
Check app mode, permission advanced access, WABA billing/payment requirements, phone-number quality, template approval for business-initiated messages and whether the recipient has opened a customer service window.
Embedded Signup finishes but the website has no connection.
Confirm the server receives the returned WABA ID, phone number ID and exchangeable code, exchanges the code server-to-server, registers the phone number, subscribes the WABA to webhooks and stores the connection against the correct tenant and chatbot.
Use Meta’s documentation as the source of truth because interfaces, permissions, versions, billing rules and eligibility can change.
Cloud API Get Started · Embedded Signup · Webhooks · Business verification · Add an app to a business portfolio