Guide · Access · For the owner who clicked through the connection screen
What access did you give your WhatsApp provider? Meta's three kinds of key, the five permissions, and the list the owner can read
Somewhere in the setup, the owner or a staff member clicked through a Meta screen that asked for permissions, and the provider's system has been able to send and read messages ever since. What exactly was granted, to whom, and for how long? Meta's developer pages answer this in the language of tokens and scopes. Translated, it comes to three kinds of key, five named permissions, and one list in Meta Business Suite that the owner can read at any time.
Published 1 October 2026
Three kinds of key
- A person's key
- Meta calls it a user access token. It is tied to whoever is signed in, expires within hours, and Meta says it is for a first test message, not for running a business. If a provider's system depends on one, someone is signing in again every few hours, or the system stops.
- The business's own key
- A system user access token. It represents the business itself rather than a person, lives long, and belongs to a system user the business creates in its own Meta Business Suite. Meta describes two kinds: an admin system user, which can reach every WhatsApp account and Messaging account in the portfolio by default, and an employee system user, which reaches only the accounts it is explicitly assigned to. This is the arrangement when a business connects its own software directly.
- The provider's key for one customer
- A Business Integration System User access token. Meta's page says this is what a Tech Provider uses: a key scoped to one onboarded customer, created when that customer completes Meta's connection screen, carrying only the permissions the customer granted. The provider holds a separate such key for each business it serves.
What that means for the owner
The five permissions, in plain words
- Manage the Messaging account. Meta's management permission covers the account's details, templates, the list of business numbers, all analytics, and notices of changes to the account. Without it the provider cannot submit templates or pull the reports in the analytics guide.
- Send and receive messages. The messaging permission is what lets the system send any message and receive incoming messages and delivery updates. This is the one that puts the provider's system in the position described in the privacy guide.
- Manage the business portfolio. Meta says this is rarely needed, because the portfolio is normally run from Meta Business Suite by a person. A provider asking for it should be able to say why.
- Two marketing extras. One for reporting conversion events when marketing templates are sent through Meta's marketing messages route, one for reading advertising insights. Only relevant if the business runs that kind of campaign.
Meta adds a safeguard on the provider's side: an app that reaches other businesses' accounts must pass Meta's App Review and hold what Meta calls Advanced access for each permission, or customers cannot grant it on the connection screen at all. A request that failed for want of access comes back with Meta's access error, listed in the failure reasons guide.
The list the owner can read
Meta's page gives the click path for seeing, and changing, who has access. In Meta Business Suite, pick the business portfolio, open its settings, then Accounts, then either WhatsApp accounts or Messaging accounts, select the account, and open the People tab. Every person and system user with access is listed there with their level. Meta notes that access has to be granted on both the WhatsApp account and the Messaging account, and that in Business Suite the grant does not carry from one to the other, so the list should be read on both. The two accounts are explained in the account split guide.
Access can also be narrowed. Meta describes partial access, under which a system user is limited to certain assets or actions, its example being a department that may only view template data and number details. An owner who wants a second agency to see reports but not send can ask for exactly that.
Questions
Our provider asked us to send them the token. Is that normal?
No. Meta describes a provider's key as one created automatically when you complete the connection screen, and tells developers to treat tokens as opaque secrets. A provider should never need an owner to copy a key out of Meta Business Suite and send it over.
If we stop working with the provider, does their key stop working?
The key reaches your accounts only through the access shown on the People tab and the permissions granted on the connection screen. Removing the provider's business and its system users from both accounts in Meta Business Suite withdraws that access. Check both the WhatsApp account and the Messaging account.
Can we see what a key is allowed to do?
Meta provides a token debugger that lists the permissions granted on a given token. In practice the owner reads the People tab, and asks the provider which of the five permissions its app holds and why.
Why does the provider need management access if all we want is to send messages?
Because templates, business numbers, analytics and account change notices all sit behind the management permission. A system that only sent and received, with no templates, could do without it, but that is not a system most businesses want.
Sources
- Meta's developer documentation: access tokens, read 1 October 2026.
- Meta's developer documentation: permissions, read 1 October 2026.
More plain-language notes like this one are on the guides page.
Want to know exactly what access your WhatsApp system holds, and why?
We set up a business's WhatsApp number on a proper system through Meta's own connection screen, hold only the permissions the screen listed, never ask an owner for a key, and show the People tab on both accounts so the business can see and withdraw access itself. A short call is the easiest way to see whether it fits your business.
Book a demo