Access Tokens (Temporary vs Permanent)

The difference between a temporary access token and a permanent system-user token in the WhatsApp Cloud API, and how to generate each.

On this page

Temporary access token
Permanent system-user token
Walkthrough screenshots
Frequently asked
Gotchas & common mistakes

There are two types of access tokens used to authenticate WhatsApp Cloud API calls: a temporary token for testing and a permanent system-user token for production. Using the wrong one is the most common reason API calls suddenly stop working.

Temporary access token#

Generated directly in the Meta developer dashboard under WhatsApp → API Setup → "Generate access token". It works immediately but expires in about 1 hour. Use only for testing — never in production.

Permanent system-user token#

Generated via Meta Business Manager (business.facebook.com):

Open Business Settings
Go to business.facebook.com, open your business portfolio, and click into its Settings.
Open System Users
Go to Users → System Users. A new portfolio starts with no system users.
Create a system user
Click Add, give it a name, and set its role to Admin.
Assign assets to the system user
A new system user has no access to anything yet. Use Assign assets to give it full control over both the app and the WhatsApp Business Account — skipping either one causes the token to fail for that asset later.
Generate the token
Click Generate token on that system user, select the app, and assign the required permissions (whatsapp_business_messaging, whatsapp_business_management, whatsapp_business_manage_events).
Save it immediately
Copy the token and store it securely — Meta only shows it once.
Verify it
Paste the token into the Meta Access Token Debugger (developers.facebook.com/tools/debug/accesstoken/) to verify it is valid and check its expiry — a permanent token shows "Never" as expiry.

Use the permanent token in all production API calls.

Walkthrough screenshots#

Generate temporary access token — The API Setup screen showing the Generate access token button.

Meta Business Suite — opening a business portfolio's Settings

System Users screen with no system users added yet

Create system user modal with name field and Admin role

System user created with no assets assigned

Assign WhatsApp Business Account full control to system user

Generate token — selecting WhatsApp business permissions

Token created — copy it now, it is shown only once

Token debugger — The Meta Access Token Debugger for verifying a token's validity and expiry.

Frequently asked#

Why did my WhatsApp API stop working overnight?

Almost certainly your temporary access token expired (~1 hour). Switch to a permanent system-user token for any production use.

How do I get a token that never expires?

Create a system user in Meta Business Manager, assign it full control over the app and the WhatsApp Business Account, generate a token for it with the WhatsApp permissions, and use that token in your API calls. It does not expire.

What is a system user?

A non-human admin account in Meta Business Manager used to generate permanent tokens for automated systems (bots, integrations). It is not tied to a personal Facebook account, so it won't expire when someone leaves the team.

How do I check if my token is valid?

Paste it into the Meta Access Token Debugger at developers.facebook.com/tools/debug/accesstoken/ and click Debug. It shows the token's expiry, permissions, and whether it is still valid.

Gotchas & common mistakes#

Temporary token expires in ~1 hour — the single most common reason integrations break. Always use a system-user token in production.
Token is shown only once — when you generate a system-user token, copy it immediately. If you lose it, you must generate a new one.
Permissions matter — the system user token needs at minimum whatsapp_business_messaging to send messages. Missing permissions cause authentication errors even with a valid token.
Token belongs to the system user, not a person — if you use a personal user token instead, it may stop working if that person's account changes.
Forgetting to assign assets — a system user generates a token fine even with no assets assigned, but that token will fail to call the app or the WhatsApp account it was never given access to. Assign both the app and the WhatsApp Business Account with full control before generating the token.

Was this page helpful?

Still stuck? Open a support ticket and our team will help.