A Meta System User access token gives WhatsApp Notification and Messaging for WooCommerce a longer-lasting connection to the WhatsApp Cloud API. It is commonly called a permanent access token, although Meta can still revoke or invalidate it.
This guide explains how to generate the token in Meta Business Settings, validate it in the extension and replace or disconnect it later. If you are still preparing your Meta app, WhatsApp Business Account or sending number, begin with the main account setup guide.
Temporary and System User access tokens
↑ Back to topThe Temporary Access Token field supports the extension’s temporary-token exchange workflow. Temporary tokens expire and the extension stores a numeric expiry for the exchanged credential.
The Meta System User Access Token field is for a token generated for a System User in Meta Business Settings. The extension validates this token directly; it does not send it through the temporary-token exchange. A token generated without a scheduled expiry can still stop working if it is revoked, its permissions or assigned assets change, the System User is removed or Meta invalidates it.
What you need
↑ Back to top- Administrator access, or suitable equivalent access, to the Meta Business Portfolio that owns the required assets.
- A Meta app connected to that business.
- The correct WhatsApp Business Account and registered sending phone number.
- Permission to create or manage a System User and assign business assets to it.
- The WhatsApp Business Account ID, Phone Number ID, App ID and App Secret used by this extension.
Permissions and asset access
↑ Back to topFor this extension, generate the token with whatsapp_business_management and whatsapp_business_messaging. The first permission lets the extension validate the configured WhatsApp account and retrieve the account resources it manages. The second permits WhatsApp Cloud API messaging operations.
Meta may also require business_management while an administrator assigns business assets or generates a System User token in Business Settings. The extension does not add that permission to its Temporary Access Token flow and does not require it merely to store the System User credential.
Generate a Meta System User access token
↑ Back to top- Open Meta Business Settings for the Business Portfolio that owns the Meta app and WhatsApp Business Account.
- Open Users > System users.
- Select an existing System User intended for this integration, or use Add to create one. Use the least access that still permits the required asset assignments.
- Choose Assign assets. Assign the correct Meta app and give the System User the app-management access Meta requires for token generation.
- Assign the correct WhatsApp Business Account and the required management access. Confirm that the intended sending number belongs to that account.
- Select Generate token for the System User and choose the same Meta app used by the extension.
- Select
whatsapp_business_managementandwhatsapp_business_messaging. If Meta presentsbusiness_managementas a requirement for this Business Settings operation, select it for token generation and asset administration. - If Meta currently offers a token-expiration choice, select Never for a token without a scheduled expiry. If that choice is unavailable, use the expiry options Meta provides for your account.
- Generate the token and copy it immediately to a secure password or secrets manager. Meta may show the complete value only once.
Meta changes labels and screen layout over time. If a label differs slightly, use the System User, asset assignment and token-generation controls for the same Business Portfolio, app and WhatsApp Business Account.
Connect the token to the extension
↑ Back to top- In WordPress Admin, go to WP & WC WhatsApp Integration > Account Setup.
- Confirm the WhatsApp Business Account ID, App ID, App Secret Key and Phone Number ID belong to the same Meta business and app used to generate the token.
- Paste the new secret into Meta System User Access Token.
- Select Save and validate. The extension makes a read-only request to the configured WhatsApp Business Account and confirms that the configured Phone Number ID is assigned to it.
- When validation succeeds, Account Setup displays System User token connected. The saved token is not placed back into the field or rendered in the page.
Webhook configuration is a separate step. A valid access token connects outbound and account-management operations; incoming messages, keyword replies and message-status callbacks also require the webhook URL, verify token and App Secret described in the webhook setup section.
Validate an existing connection
↑ Back to topAfter updating from an earlier version, an existing credential with the legacy never expiry remains connected and is excluded from temporary-token refresh. Select Validate existing token as System User to verify and classify it without displaying, copying or re-entering the secret.
Replace the token
↑ Back to top- Generate the replacement token for the correct app and assigned WhatsApp Business Account.
- Paste it into Meta System User Access Token.
- Select Replace token.
The extension validates the candidate first. If validation fails, it keeps the currently working stored token and shows a general error that does not reveal either credential.
Disconnect this site
↑ Back to topSelect Disconnect from this site to delete the local bearer, token type, expiry metadata and related cached connection state. This action does not revoke the token in Meta. If the token should no longer work anywhere, revoke it separately in Meta Business Settings.
Keep the token secure
↑ Back to top- Treat the token as a password.
- Never include it in screenshots, support tickets, documentation, browser URLs or logs.
- Store the original value in a trusted password or secrets manager.
- Assign only the required app, WhatsApp Business Account, phone and permissions.
- If the token is exposed, revoke it in Meta, generate a replacement and validate the replacement in Account Setup.
Troubleshooting
↑ Back to topThe app does not appear when I generate a token
↑ Back to topConfirm that the app belongs to, or is shared with, the same Business Portfolio and that it has been assigned to the selected System User with the required access.
The WhatsApp account or phone is unavailable
↑ Back to topAssign the correct WhatsApp Business Account to the System User. Then confirm that the Phone Number ID in Account Setup belongs to that account.
A required permission is unavailable
↑ Back to topCheck the app’s business association, WhatsApp product setup and the System User’s assigned assets. Meta only lists permissions that are available to the selected app and business context.
The extension rejects the token
↑ Back to topConfirm that the token belongs to the configured app and business, includes both WhatsApp permissions, can access the configured WhatsApp Business Account and can see the configured Phone Number ID. A failed replacement does not overwrite the current working token.
The Never option is unavailable
↑ Back to topUse the expiry choices Meta currently provides for your account. Do not assume a token is non-expiring unless Meta explicitly shows that selection when the token is generated.
A previously working token stopped working
↑ Back to topCheck whether the token was revoked, the System User or assigned assets changed, the app or WhatsApp account was removed, or Meta invalidated the credential. Generate and validate a replacement if required.
Frequently asked questions
↑ Back to topIs a Meta System User access token truly permanent?
↑ Back to topNo. “Permanent access token” is a common name for a System User token generated without a scheduled expiry. Meta can still revoke or invalidate it.
Which permissions are required?
↑ Back to topThe extension uses whatsapp_business_management and whatsapp_business_messaging. Meta may also require business_management during System User asset assignment or token generation; it is not added to the extension’s temporary-token OAuth request.
Why can’t I see my app or WhatsApp Business Account?
↑ Back to topThe selected System User must belong to the correct Business Portfolio, and the correct app and WhatsApp Business Account must be assigned to it.
Do I still need to configure the webhook?
↑ Back to topYes. Webhook setup is separate and is required for incoming messages, keyword replies and message-status callbacks.
What should I do if the token is exposed?
↑ Back to topRevoke it in Meta Business Settings, generate a replacement and use Replace token in Account Setup. Do not send the exposed value to support.
Return to the authentication instructions or review the complete WhatsApp Notification and Messaging documentation.