How to Generate a Permanent WhatsApp Token
This guide walks you through creating a permanent (system user) access token for your WhatsApp Business account in Meta Business Suite, and then using it in BoldDesk. The token authorizes BoldDesk to send and receive WhatsApp messages on your behalf—without requiring you to log in each time.
Follow these steps to create a permanent access token for your WhatsApp Business account:
- Sign into the Meta Business Suite.
- Select your business account in the top-left dropdown menu and click its Settings (gear) icon.
- Navigate to Users > System users.
- Click the Add button and accept it.
- In the Create system user dialog box, fill in the System username section.
- Then select the System user role as ‘Admin’ and click the Create system user button.
This step is only necessary if an admin user has not already been created. If an admin user already exists, you can use this for token generation.
- On the same page, click the Assign Assets button.
- Proceed to Select asset type, click on Apps from the left, and select assets from the list of available apps.
- Enable the Full control toggle button for managing your app and click the Assign assets button.
- Click the Generate token button.
- Select the desired app from the dropdown (Select App) and click Next.
- Set the token expiration period and click Next.
To generate a token with a 60-day expiry, ensure that you renew it before it expires. You can do this on the BoldDesk WhatsApp Configuration page by clicking the Reconfigure button.
- Scroll to Assign Permissions and select whatsapp_business_messaging and whatsapp_business_management from the list. Click the Generate Token button at the bottom.
- Copy the Token and paste it to the WhatsApp Token field on the BoldDesk WhatsApp Configuration page.
Frequently Asked Questions (FAQ)
Q1: What is the WhatsApp Business access token used by BoldDesk?
A: It’s a system user access token you generate in Meta Business Suite for your WhatsApp Business app. BoldDesk uses this token to securely send and receive WhatsApp messages on your behalf—without requiring you to log in each time.
Q2: Who can create the WhatsApp Business access token, and where is it created?
A: A Meta Business Admin creates it in Meta Business Suite → Users → System users. You either create a System User (Admin) or reuse an existing one, then generate the token for your WhatsApp Business app.
Q3: What are the essential steps to generate the WhatsApp Business access token?
A:
- In Meta Business Suite, go to Users → System users (create/reuse System User – Admin).
- Click Assign Assets, choose your App, enable Full control, then Assign.
- Click Generate token, select your App, set expiry, choose permissions, and Generate.
- Copy the token and paste it into BoldDesk → WhatsApp Configuration → WhatsApp Token, then Save.
Q4: Which permissions must be selected for the WhatsApp Business access token?
A: Select both permissions during token generation:
whatsapp_business_messaging(allows sending/receiving messages)whatsapp_business_management(allows managing the WhatsApp Business connection)
Q5: How long does the WhatsApp Business access token last, and how do I renew it?
A: You choose the expiry (e.g., 60 days) when generating the token. Before it expires, create a new token in Meta Business Suite and update it in BoldDesk → WhatsApp Configuration (use Reconfigure if visible), then Save.
Q6: Where do I paste the WhatsApp Business access token in BoldDesk?
A: Go to BoldDesk → WhatsApp Configuration, paste the token into the WhatsApp Token field, and Save. This activates the WhatsApp connection for your helpdesk.
Q7: What should I do if the WhatsApp Business access token stops working or expires?
A: Regenerate a new token in Meta Business Suite (ensure the same app and the two permissions above), then replace it in BoldDesk → WhatsApp Configuration and Save. If you changed apps or assets, revisit Assign Assets and enable Full control.
Q8: How should I protect the WhatsApp Business access token?
A: Treat it like a password: don’t share it, don’t publish it online or in code repositories, and rotate (regenerate) it immediately if you suspect exposure.
