Business Phone Numbers: Eligibility, Registration & Two-Step PIN

Almost any real phone number you own can become a WhatsApp business number on the Cloud API, as long as it has a country and area code and can receive an SMS or a voice call. Getting it live takes three steps: add the number to your WhatsApp Business Account, verify that you own it with a code sent by SMS or voice call, then register it for the API with a 6-digit two-step verification PIN.

After registration the number keeps working for normal phone calls and text messages, but it can no longer be used in the regular WhatsApp app. If the number is on WhatsApp today, see Move Your Existing WhatsApp Number to the API first.

Which numbers can you use?#

Meta's eligibility rules: the number must

• be owned by you,
• have a country and area code (short codes are not supported),
• be able to receive voice calls or SMS (that is how the verification code arrives),
• have scaled capabilities.

Two kinds of number need extra work first:

• A number already in use with WhatsApp cannot be registered until its WhatsApp account is deleted. See Move Your Existing WhatsApp Number to the API (or Coexistence if you want to keep the WhatsApp Business app).
• A number banned on WhatsApp must be unbanned through WhatsApp's appeal process before it can be registered.

Which type of number receives the code best#

The verification code arrives by SMS or by voice call, and some number types handle one better than the other. Meta's guidance:

So a landline or VoIP number usually works: choose the voice call option when you request the code. Whatever the type, make sure the line can receive international calls and SMS, and turn off call forwarding or IVR menus while you verify.

Toll-free and 1-800 numbers behind a phone menu (IVR)#

The automated registration call cannot press menu buttons. A number behind an IVR can still be registered if it accepts calls from international numbers and can pass the call or SMS to a real person:

1. 1

   Get the calling numbers

   WhatsApp shares one or two phone numbers the registration call will come from.

2. 2

   Allow-list them

   Add those numbers to an allow list on your phone system. If you can't, add the phone number to your WhatsApp Business Account and open a Direct Support ticket asking for the registration call numbers, including the number you are trying to register.

3. 3

   Route the call to a person

   Send the registration call to an employee or a mailbox so someone can capture the code.

IVR numbers that cannot receive the registration call are not supported.

How many numbers can you register?#

When the cap goes up, Meta sends a Meta Business Suite notification, and a business_capability_update webhook fires with max_phone_numbers_per_business set to the new cap.

How to get a number live#

1. 1

   Add the number

   Add it to your WhatsApp Business Account in any of these places: the App Dashboard (WhatsApp → API Setup), Meta Business Suite (when creating a WhatsApp Business Account), WhatsApp Manager, or the Embedded Signup link your WhatsApp provider (BSP) gives you. You will also enter a display name; see Business Verification, Display Name & Green Tick.

2. 2

   Verify you own it

   Request a code by SMS or voice call and enter it. This proves ownership.

3. 3

   Register it for the API

   Adding and verifying a number does not register it for the Cloud API. Registration is a separate API call (/register) that includes a 6-digit PIN. You cannot register a number from WhatsApp Manager or the App Dashboard; it is API only. If you onboard through a provider's Embedded Signup, the provider makes this call for you.

4. 4

   Check it shows Connected

   A number must have the status Connected to send and receive messages. You can see the status in WhatsApp Manager → Account tools → Phone numbers.

Registration limits and errors#

Re-registering after a display name change#

If the number is already registered and you change its display name, wait until the name change is approved (the phone_number_name_update webhook confirms it), then register the number again. Re-registering before approval has no effect.

The two-step verification PIN#

The two-step verification PIN is a 6-digit code that protects the number. You set it the first time you register the number. When the number does not have a PIN yet, the 6 digits you send with the registration call become its PIN. If it already has one, you must send that existing PIN. You also need the PIN to change it, or to delete a Connected number.

Change or reset the PIN#

Turn the PIN off#

Only from WhatsApp Manager: follow the change-PIN steps, but click Turn off two-step verification at the end. Meta emails a link to the address on your business portfolio; open it to finish. You can turn it back on later by setting a new PIN. There is no API call to turn two-step verification off.

Deregistering vs deleting a number#

To use a deregistered number on the API again, register it again. To delete a number, open WhatsApp Manager → Account tools → Phone numbers and click the trash can icon. If the number sent paid messages in the last 30 days, you are sent to Insights, which shows the date of the last paid message; you can delete the number 30 days after that date.

API reference#

All calls use the Phone Number ID (see the WhatsApp API Glossary) and a system user access token (see Access Tokens).

1. Request a verification code (code_method is SMS or VOICE):

curl -X POST 'https://graph.facebook.com/v26.0/<PHONE_NUMBER_ID>/request_code?code_method=SMS&language=en_US' \
  -H 'Authorization: Bearer <ACCESS_TOKEN>'

2. Submit the code:

curl -X POST 'https://graph.facebook.com/v26.0/<PHONE_NUMBER_ID>/verify_code' \
  -H 'Authorization: Bearer <ACCESS_TOKEN>' \
  -F 'code=<CODE>'

3. Register the number with a 6-digit PIN:

curl 'https://graph.facebook.com/v26.0/<PHONE_NUMBER_ID>/register' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <ACCESS_TOKEN>' \
  -d '{
    "messaging_product": "whatsapp",
    "pin": "212834"
  }'

An optional data_localization_region (a 2-letter country code such as IN) turns on local storage of data at rest in that country. To change or remove it later, deregister and register again.

Set or change the PIN (no current PIN needed):

curl 'https://graph.facebook.com/v26.0/<PHONE_NUMBER_ID>' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <ACCESS_TOKEN>' \
  -d '{ "pin": "150954" }'

Check the status:

curl 'https://graph.facebook.com/v26.0/<PHONE_NUMBER_ID>?fields=status' \
  -H 'Authorization: Bearer <ACCESS_TOKEN>'

{ "status": "CONNECTED", "id": "106540352242922" }

Deregister:

curl -X POST 'https://graph.facebook.com/v26.0/<PHONE_NUMBER_ID>/deregister' \
  -H 'Authorization: Bearer <ACCESS_TOKEN>'

The verify-code, set-PIN and deregister calls return { "success": true } when they work.

Frequently asked#

Gotchas & common mistakes#