Guide · Setup · For the owner asked to make a provider an admin
What connecting a business to the WhatsApp Cloud API actually involves: Meta's seven steps, and who should own each piece
When a provider connects your WhatsApp number to a proper system, they follow a set of steps Meta publishes for developers. Owners rarely see that page, so the access requests arrive without context: a developer account, a Meta app, a business portfolio, a system user, a permanent token. Here are Meta's own seven steps in plain language, with one question answered at each: what is being created, and who should own it.
Published 1 October 2026
Meta's seven steps, in order
- Register as a developer. Meta's page starts with a Facebook account or a managed Meta account registered as a developer, plus a phone with WhatsApp for testing. This is the person who will build; it does not have to be you, but it should not be a stranger's personal account either.
- Create a Meta app for WhatsApp. In Meta's app dashboard the developer creates an app, picks the use case Meta calls connecting with customers through WhatsApp, and attaches it to a business portfolio, existing or new. The app is the technical identity your messages will travel under.
- Connect the app to a Messaging account. The app is linked to a WhatsApp Messaging account, chosen from the portfolio or created with a business profile. Meta notes that a new portfolio may have had one created automatically.
- Send a first test message. Meta issues a temporary access token, the developer picks a sending number, enters a receiving number, and sends a test. Meta's page then says to reply from the phone, which matters more than it looks: the reply opens the 24-hour customer service window used in step six.
- Set up a webhook. A webhook is the address Meta sends notices to: that a message was delivered, that it was read, that a customer wrote back. Without one your system is deaf. Meta provides a test version for this stage.
- Create a system user and a permanent token. The temporary token expires quickly. Meta's page has the developer create a system user in Business Settings, give it full control of the app and of the WhatsApp account, and generate a permanent token with three permissions covering business management, WhatsApp messaging and WhatsApp account management. This token is the key to your number; Meta says to store it securely.
- Send a free-form message inside the window. Because the phone replied in step four, the window is open and a plain message, not a template, can be sent. The webhook from step five confirms it arrived. Meta's page calls sending messages and receiving webhooks the fundamental building blocks; everything else is built on them.
Who should own each piece
- The business portfolio
- Yours. It is the container for your WhatsApp account, your verification and your payment method. A provider should work inside it as a partner or employee, not hold it.
- The Meta app
- Meta's steps create it inside the portfolio you chose. If it sits in the provider's portfolio instead, your messaging depends on their account continuing to exist and to like you.
- The system user and its token
- Meta's page gives the system user full control of both the app and the WhatsApp account. Whoever holds that token can send as your number. It belongs in your portfolio's Business Settings, where you can see it, and revoke it, the day the relationship ends.
- The webhook address
- This is the provider's system, which is normal; it is where your messages are shown to you. What you should know is where the data it receives is stored and how you get it out.
Why the test token is not enough
What comes after the seven steps
Meta's page lists the next things to learn once messages flow both ways: the non-template message types, templates for messaging outside the window, creating and managing WhatsApp groups through the API, sending and receiving calls, adding a real business number in place of the test one, and running your own webhook server. It also points businesses already using the WhatsApp Business app to Embedded Signup, which connects their existing account and number to the Cloud API without starting over. The 24-hour window guide, the registration guide and the display name guide cover the pieces that follow.
Questions
Our provider asked to be made an admin on our business portfolio. Is that normal?
Meta's steps need someone to create an app in the portfolio, connect it to the WhatsApp account, and create a system user with full control of both. That requires real access. What is not required is that the portfolio, the app or the system user belong to the provider; they can and should be created in yours.
What is a webhook, in one line?
The address Meta sends notices to: delivered, read, failed, and every message a customer writes. Meta's page introduces it specifically so you can see message statuses.
Why did the test work from the phone but a message sent the next day fail?
Two likely reasons from Meta's own steps. The temporary token from the first test expires quickly, and the 24-hour window opened by the test reply closes after a day, after which only a template can be sent.
We already use the WhatsApp Business app. Do we start from scratch?
Meta's page points to Embedded Signup for exactly that case, which connects the existing account and number to the Cloud API. Whether to keep the app alongside is a separate decision with its own trade-offs.
Sources
- Meta's developer documentation: WhatsApp Cloud API, Get started, read 1 October 2026.
More plain-language notes like this one are on the guides page.
Want the connection built inside your own business portfolio, not ours?
We set up a business's WhatsApp number on a proper system following Meta's own steps, with the app, the account and the system user created where the business can see them and revoke them, and the webhook delivering every message into one place the business owns. A short call is the easiest way to see whether it fits your business.
Book a demo