Quick Answer
The access token shown on the WhatsApp API Setup page is a temporary token that expires after roughly 24 hours. For production, create a system user in your business settings, assign it your WhatsApp Business Account with full control, and generate a token with the whatsapp_business_management and whatsapp_business_messaging permissions. That token does not expire on a schedule. If you see error 190 (invalid or expired OAuth access token), this is the fix.
Last checked October 2026. Meta renames menus and changes review rules often, so treat the steps as the path, and confirm the exact wording on screen against Meta's documentation.
Why Tokens Expire
| Token type | Lifetime | Use it for |
|---|---|---|
| Temporary token (API Setup page) | About 24 hours | Quick tests only |
| User access token (from login) | Short or long-lived, but tied to a person | Interactive flows, not servers |
| System user token | No scheduled expiry (you can revoke it) | Production integrations |
A token tied to a person also breaks when that person changes their password, leaves the company or loses access. A system user is a non-human identity owned by the portfolio, so it survives staff changes.
Create a System User Token
- Open Business settings > Users > System users in the portfolio that owns the WhatsApp account.
- Click Add, name it (for example "Tenreply API"), and choose the Admin role.
- Click Add assets, choose WhatsApp accounts, select your WABA and grant full control.
- Click Generate token, pick the app that is connected to your WhatsApp setup, set the expiry to never if offered, and tick
whatsapp_business_managementandwhatsapp_business_messaging. - Copy the token immediately. Meta shows it once. Store it in a secrets manager, not in a spreadsheet or chat.
In Tenreply, paste it into the System User Access Token field of the manual connection form together with your WABA ID and Phone Number ID. Connecting through Embedded Signup handles the credentials for you, and Tenreply encrypts stored channel tokens at rest.
Error Messages and What They Mean
| Error | Meaning | Fix |
|---|---|---|
| 190 / "Error validating access token" | Token expired, revoked or tied to a password change | Generate a new system user token. |
| 10 / 200 / "permissions error" | Token lacks a permission or the system user lacks the asset | Add the WABA to the system user with full control; regenerate with both WhatsApp permissions. |
| 100 / "Unsupported post request" | Wrong ID, or the token cannot see that object | Check the IDs and asset assignment. |
| "Application does not have permission" | App is not approved for the permission at scale | Use a platform whose app is approved, or complete app review. |
Token Security Rules
- Never put a token in front-end code, a public repository or a screenshot.
- Use one system user per integration, so you can revoke one without breaking others.
- Rotate the token if a team member who saw it leaves.
- Revoke tokens you no longer use from the system user's page.
For hardening the people side, see how to protect business accounts from hackers.
Frequently Asked Questions
Why does my WhatsApp token stop working after a day?
You are using the temporary token from the API Setup page. Replace it with a system user token.
Is "never expires" really permanent?
It has no scheduled expiry. It still stops working if you revoke it, remove the system user, or remove its asset access.
Which permissions does the token need?
At minimum whatsapp_business_management and whatsapp_business_messaging. Catalog features need additional catalog permissions.
Do I need to do this if I connect through Embedded Signup?
No. The platform receives access through the Meta popup. Manual tokens are the fallback route.
Let the Connection Manage Itself
Connect with Embedded Signup and skip token generation entirely, or paste a system user token if you prefer the manual route.
- Connect your number in Tenreply: Meta's Embedded Signup walks you through the WhatsApp Business Account, the number and the OTP in one popup, and Tenreply subscribes the webhook for you. If Meta does not return the IDs, enter them by hand on the same screen.
- WhatsApp API pricing calculator: estimate Meta's charges before you scale.
- Template message previewer: check how a template renders before you submit it.
- Security, changelog and roadmap: what is live today and what is coming.
Back to the full map: Meta, WhatsApp and Instagram integration problems: the complete fix guide.