How to Apply for WhatsApp Business API Access

Quick answer: There is no application queue. Create a Meta business portfolio, a WhatsApp account and a Messaging account (the old WABA, split from 23 September 2026), register a number via the API, make a system-user token, verify a webhook and get a template approved (up to 24 hours). You start at 250 unique users a day.

If you are asking “how do I apply for WhatsApp Business API access for my business”, Meta’s WhatsApp Business Platform gives you a test number the day you create a Meta app. The real gates come later: a phone number not tied up in a WhatsApp app, a token that doesn’t expire, a public webhook, an approved template and a messaging limit big enough for your list. Everything below comes from Meta’s developer documentation, the Meta Business Help Centre and the WhatsApp Business Messaging Policy, read on 12 October 2026, and covers the WhatsApp Cloud API, Meta Business Suite, WhatsApp Manager, Embedded Signup, Solution Partners and Tech Providers.

Is it still a “WABA”? What changed in September 2026

As at 12 October 2026, Meta is splitting the WhatsApp Business account (WABA) in two. Its account model page says a WhatsApp account (WAAC) holds one business phone number and your business identity, and a Messaging account holds templates, billing and webhook subscriptions. The rollout began on 23 September 2026 and should reach all businesses “by mid-October 2026”; until yours is migrated, WhatsApp Manager still shows the old single-WABA screens.

For anyone applying now: your WABA ID becomes your Messaging account ID, existing endpoints and tokens keep working, you need both accounts to send anything, and verification, display names and messaging limits are unchanged. Later phases (H1 2027 and H1 2028) introduce WhatsApp account IDs and eventually require them in API paths.

How to apply for WhatsApp Business API access: the 11 steps

This is the direct route through the WhatsApp Cloud API; a partner runs the same sequence through Embedded Signup (step 3). Each step names the first action and the finish state.

1. Create or choose a Meta business portfolio

First action: sign in at business.facebook.com with a Facebook profile or managed Meta account and create a business portfolio named as your business is publicly known (each person can create up to two), then register as a Meta developer. Older Meta pages, including the system users guide, still say “Business Manager”. Finished when: you hold full control of the portfolio.

2. Decide whether to verify the business now

First action: in Meta Business Suite’s Security Centre, click Start verification. Meta’s verification article asks for the legal name, address, phone number and an HTTPS website, then a way to confirm your connection (email, phone, text, WhatsApp message or domain). Without a matching record you may need documents such as a business licence. A decision “may take up to 14 working days”, and editing your details later means verifying again. Finished when: the portfolio is verified, or you have chosen to scale through volume instead.

3. Choose your route: direct Cloud API, Tech Provider or Solution Partner

First action: decide who owns the app that calls the API. Direct, you create a Meta app with the “Connect with customers through WhatsApp” use case, and Meta’s permissions page says a direct developer using only its own data does “not need to undergo App Review”. Through a partner you complete Embedded Signup, which Meta says lets clients “start sending messages in less than five minutes”, and you own the assets it creates. Numbers no longer migrate between Solution Partners; you share your WhatsApp account instead, with up to five Solution Partners. Finished when: your app is connected to a Messaging account in API Setup, or your partner has your account and phone number IDs.

4. Pick a phone number WhatsApp will accept

First action: check Meta’s eligibility rules: owned by you, with a country and area code (no short codes), able to receive voice calls or SMS, and, the same list adds, “have scaled capabilities”. A number in use with WhatsApp must be deleted from the app first (losing its history; Meta says it frees up within 3 minutes), and a banned number must be unbanned on appeal. The exception is coexistence: a Solution Partner or Tech Provider can onboard a WhatsApp Business app number so app and API run side by side, on app version 2.24.17 or later at a fixed 20 messages per second. Finished when: the number passes its SMS or voice code.

5. Set a display name that will pass review later

First action: enter a display name when you add the number. Meta’s Help Centre says you don’t need a display name review “to get started” and “can begin sending messages to customers immediately”. Review happens automatically once you reach a higher messaging limit, against Meta’s display name guidelines: no generic terms or bare place names, no “Official” or “Verified”, no reference to Meta or its apps, no promotional wording, no website or email format, nothing that breaches the WhatsApp Business Messaging Policy, and a clear link to your legal name (“by [company name]” where needed) with branding consistent with your website and other external sources. The pages we read give no review time. You can change the name 10 times per 30 days and must re-register within 14 days of an approval. Finished when: the name is saved.

6. Create the WhatsApp account and Messaging account

First action: add your production number in API Setup, which Meta says “generates a WhatsApp account containing that number, along with a Messaging account for your templates and billing” (Meta Business Suite can also create each one). New business portfolios start capped at 2 registered numbers and 250 templates per Messaging account. Verification, or reaching the 2,000 messaging limit, raises the number cap to 20; verification plus an approved display name raises the template cap to 6,000. Add a payment method: Meta’s pricing page says that without one, service messages stop after the free 1,000 per number per month. Finished when: both account IDs and a payment method show.

7. Register the number through the API

First action: call POST /<PHONE_NUMBER_ID>/register with a 6-digit PIN. Meta’s registration page says registration happens only through the API, at most 10 requests per number per 72 hours (error 133016 then locks it for 72 hours), and within 14 days of Embedded Signup. Meta is retiring the PIN for eligible numbers but asks you to keep sending one. Australian businesses can set data_localization_region to AU to store data at rest in Australia. Finished when: the status reads CONNECTED.

8. Create a system user and a permanent access token

First action: in Business Settings > System users, add a system user, assign it your app (Manage app) and your accounts, then generate a token with business_management, whatsapp_business_management and whatsapp_business_messaging. The dashboard’s temporary token “expires quickly”. Meta’s access tokens guide flags a common trap: an employee system user needs access to both accounts, and Meta Business Suite does not cascade the grant. Missing access returns error code 200 (not HTTP 200). Finished when: debug_token shows all three scopes.

9. Stand up and verify a webhook

First action: deploy an HTTPS endpoint with a valid, non-self-signed certificate and enter its URL and a verify token in the app’s Configuration panel. Meta’s webhook page requires your own endpoint “before you can use your app in a production capacity”. It must echo hub.challenge on Meta’s GET and should check each POST’s X-Hub-Signature-256, an HMAC-SHA256 of the raw body keyed with your app secret. Retries run for up to 7 days, so deduplicate. We ran this check against a fixture payload: it accepted a signature computed separately with OpenSSL and rejected a tampered body, a wrong secret and a missing header.

import hmac, hashlib
def valid_signature(raw_body: bytes, header: str, app_secret: str) -> bool:
    expected = hmac.new(app_secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest("sha256=" + expected, header or "")

Finished when: the Configuration panel saves your URL and you are subscribed to the messages field.

10. Submit your first message template

First action: create a template in WhatsApp Manager or via the API, with sample values for every variable; templates are the only messages allowed outside a customer service window. Meta’s template review page says a decision can take “up to 24 hours”, appeals are decided within 24 hours, and it lists the common rejection reasons: parameter formatting (missing, mismatched or non-sequential {{1}} variables, special characters such as #, $ or % in a variable, too many variables for the message length, or a template that starts or ends with a variable), content that breaches the WhatsApp Commerce Policy or Business Messaging Policy (including requests for full card, financial account or national ID numbers, and abusive or threatening content), character limits and text format, and duplicates of an existing template. The cap is 100 new templates per hour. Finished when: the status is APPROVED.

11. Capture opt-in, then go live

First action: fix your opt-in wording. The WhatsApp Business Messaging Policy says you may only contact people if “(a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you.” Meta’s opt-in page adds three requirements: say clearly the person is opting in to messages from your business, name the business, and comply with applicable law. Opt-in can be general rather than WhatsApp-specific, collected by SMS, website, IVR or paper, and opt-outs made on or off WhatsApp must be honoured. Finished when: an opted-in contact receives your approved template from your production number and the delivery status arrives at your webhook.

The WhatsApp API onboarding critical path

The WhatsApp API onboarding critical path: each step, what must already be true, who says yes, what stops it, and the wait or limit Meta itself states. Where Meta states nothing, the cell says so.

Step	Prerequisite	Who approves	What blocks it	Meta-stated wait or limit
1. Business portfolio	Facebook profile or managed Meta account	Nobody (self-serve)	Managed account without organisation management permission	Up to 2 portfolios created per person
2. Business verification (optional to start)	Full control of the portfolio; legal details; HTTPS website	Meta	Details that don’t match the legal entity; no matching record and no documents	“Up to 14 working days”; partner-led average 5 minutes, can take several hours
3. Route: direct or partner	Meta app with the WhatsApp use case, or a partner’s Embedded Signup link	Nobody for direct own-data use; partners need App Review	Partner app without Advanced access to the permissions	Embedded Signup: “less than five minutes” to start sending
4. Phone number	Owned number with country and area code that receives SMS or voice; Meta’s list also says “scaled capabilities”	Meta (verification code)	Number still on a WhatsApp app; banned number; IVR that can’t take the call	Deleted app number free in up to 3 minutes
5. Display name	Name related to your legal name	Meta, automatically, once you reach a higher limit	Generic, promotional or Meta-referencing name	No review time published; 10 changes per 30 days
6. WhatsApp account + Messaging account	Portfolio; number	Nobody (self-serve)	No payment method on the Messaging account	2 numbers until verified or at the 2,000 limit; 250 templates until verified with an approved display name
7. Register the number	Verified number; access token	Nobody (API call)	Too many attempts (error 133016)	10 requests per 72 hours; 14 days after Embedded Signup
8. System user + permanent token	Admin access to the portfolio	Nobody (self-serve)	Access granted to only one of the two accounts (error code 200)	None published
9. Webhook	Public HTTPS endpoint, valid certificate	Meta (GET verification)	Self-signed certificate; wrong verify token	Retries for 7 days; batches of up to 1,000 updates
10. First template	Messaging account; sample values	Meta (machine learning plus manual review)	Variable formatting; Commerce or Business Messaging Policy breaches, such as requests for sensitive identifiers; character limits; duplicates	Up to 24 hours; appeal within 24 hours; 100 created per hour
11. Opt-in and go live	Opt-in naming your business	The customer	Messaging limit of 250 unique users per 24 hours	2,000 after a scaling path; then +1 level within 6 hours

Of the completion times Meta actually states in that last column, business verification is the only one measured in days rather than minutes or hours, and it is optional to start.

Do I need business verification? WhatsApp messaging limits in 2026

Verification gates scale, not sending. Meta’s messaging limits page counts unique users you deliver to outside a customer service window in a moving 24 hours, set for the whole business portfolio.

Messaging limit (unique users per 24 hours)	How you get there	Meta-stated timing
250	Every newly created business portfolio	On creation
2,000	One scaling path: verify your business; have your partner verify it; or deliver 2,000 template messages to unique users outside windows in a 30-day moving period using high-quality templates. Meta then assesses message quality and approves or denies automatic scaling.	“Immediately” on approval; no time published for the assessment itself
10,000	Automatic: high-quality messages across all numbers and templates, and at least half your current limit used in the last 7 days	Within 6 hours of meeting the criteria
100,000	Automatic, same criteria	Within 6 hours
Unlimited	Automatic, same criteria	Within 6 hours

If you remember a 1,000 tier, it is gone. Meta’s change notice says that from 7 October 2025 limits moved from each number to the portfolio, the first automatic step became 2,000 instead of 1,000, and upgrades take 6 hours instead of 24.

The arithmetic of the volume path: at 250 unique users per moving 24 hours, reaching 2,000 unique users takes at least eight rolling days (2,000 ÷ 250 = 8), and only if every template is delivered and stays high quality. A list of 1,000 opted-in leads takes at least four (1,000 ÷ 250 = 4). Verification can take up to 14 working days but runs in parallel and also lifts the number cap and, with an approved display name, the template cap. Replies inside a customer service window don’t count against the limit. Calling has its own gate too: Meta’s Cloud API Calling page lists “a daily messaging limit of at least 2,000 unique recipients” as a prerequisite (public test numbers and sandbox accounts are exempt), which our WhatsApp Calling API setup guide for AI voice agents works through.

Direct Cloud API or a partner: the threshold table

Meta’s partners page defines three partner types. A Solution Partner has a credit line and can invoice you for API usage. A Tech Provider offers the same services without a credit line, so Meta bills you. A Tech Partner is a Tech Provider that is, or is eligible to become, a Meta Business Partner. The crossover points below come from Meta’s rules.

If this is true for you…	Go direct to Cloud API	Use a Solution Partner or Tech Provider
You must keep using the WhatsApp Business app on the same number	Not possible: the number must be deleted from the app first	Yes: coexistence needs a Solution Partner or Tech Provider (fixed 20 messages per second)
You can’t or won’t put a card on a Meta account	Usually not: you add a payment method unless Meta classifies you as an invoiced customer (Terms clause 3.5)	Solution Partner only: it shares its credit line and invoices you
You want verification faster than “up to 14 working days”	Not possible: you submit it yourself	Select or Premier Solution Partners only: average 5 minutes, 3 submissions per client
You can run a public HTTPS webhook with median latency of 250 ms or less and under 1% of requests above 1 second	Yes: this is Meta’s published standard for your server	Not your problem: the partner’s endpoint receives the webhooks
You only message from your own business	Yes: no App Review needed	Optional
You will onboard other businesses (you are the agency or software vendor)	No: you need partner status	Become a Tech Provider: business verification, then App Review with two screen recordings
Your volume will pass 80 messages per second on one number	Same for both: Meta upgrades a number to 1,000 per second automatically once the portfolio has an unlimited limit, the number reaches 100,000+ unique users in 24 hours and its quality is Medium or higher	Same for both

What the direct route costs to run is what the getting-started guide leaves out: the webhook server and its uptime (Meta’s throughput page sizes it at three status webhooks per outbound message), 7 days of retries to deduplicate, token storage, template appeals, quality monitoring, and the move to WhatsApp account IDs in 2027–28. Meta’s per-message charges come on top; our breakdown of WhatsApp Business API cost per message for AI agents prices them from the October 2026 rate card.

Who runs this for you: the options, ranked

Access is the start: someone still writes templates, answers inside the window, escalates and books the meeting. Disclosure: zian.ai publishes this list and appears in it. Method: ranked by how much post-access work each option takes off the business, using published capabilities only; partner types are described from Meta’s partners page.

Rank	Option	What it does after access is granted	Who it suits
1	Zian (platform)	AI sales and reception agents that follow up on WhatsApp as one channel among voice calls, SMS, email, Instagram DMs and Facebook Messenger; SmartReach AI™ chooses message, channel and timing; 30+ languages; HubSpot, Salesforce, HighLevel and Zapier integrations	Teams that want an agent to qualify, follow up and book across channels, not just a WhatsApp inbox
2	LeadsNow.ai (managed, runs on Zian)	Done-for-you AI appointment setting, pay-per-result; leads answered in under 60 seconds, 24/7	Businesses that want booked appointments rather than software to run
3	A Meta Solution Partner	Messaging services, billing on its credit line, integration and customer support	Businesses without a card on Meta, or that need partner-led verification
4	A Meta Tech Provider or Tech Partner	Platform services through Embedded Signup; Meta bills you directly	Businesses happy to pay Meta directly and use the provider’s software
5	Direct Cloud API, built in-house	Whatever your developers build on the 11 steps above	Teams with engineers who will own the webhook, tokens and templates

Zian’s honest gap: it is in partnership-application beta with no public price, and, as at 12 October 2026, its public pages do not say which Meta onboarding route it uses, so ask during your application.

Before an AI agent sends anything on WhatsApp

Two rules decide whether an AI agent keeps access. The first is in the WhatsApp Business Messaging Policy: “You may use automation when responding during the 24-hour window, but must also have available prompt, clear, and direct escalation paths.” Meta’s examples are an in-chat human agent transfer, a phone number, email, web support, in-store visits or a support form. Our guide to AI-to-human handoff and context transfer covers the in-chat version.

The second is clause 4.7 of the Meta Terms for WhatsApp Business Platform. “AI Providers”, as Meta determines “in its sole discretion”, may not use the platform to make their AI available “when such technologies are the primary (rather than incidental or ancillary) functionality being made available for use”, except in certain countries Meta lists. You may retain an AI Provider as your Solution Provider, but WhatsApp Business Platform Data, including anonymous, aggregate or derived forms, may not be used to create, develop, train or improve AI models, except to fine-tune a model for your exclusive use that improves no other model. Our reading: a business using an AI agent for its own sales or support is not selling AI as the product, but the call is Meta’s. If an account is restricted anyway, our WhatsApp Business account restriction triage guide maps each notice to its fix.

Day-one checklist for WhatsApp Business API access

• Create the business portfolio and confirm full control.
• Start business verification today if you will need more than 250 users a day.
• Choose the number; if it is on a WhatsApp app, choose deletion or coexistence through a partner.
• Create the Meta app and send, then reply to, the test message.
• Write a display name that matches your legal name.
• Add the production number, note both IDs and add a payment method.
• Register the number (10 attempts per 72 hours).
• Create the system user, grant both accounts and store the token as a secret.
• Deploy the signed-payload webhook and subscribe to messages.
• Submit two or three templates with sample values.
• Rewrite your opt-in to name your business, and set your escalation path.

Frequently asked questions

Where every figure on this page comes from

Figure	Who published it	Link	Date read
WABA split into WhatsApp account and Messaging account; GA from 23 September 2026, all businesses by mid-October 2026; H1 2027 and H1 2028 phases	Meta for Developers	Updates to WhatsApp Business accounts	12 October 2026
Messaging limits 250, 2,000, 10,000, 100,000, unlimited; 2,000 messages in 30 days; half the limit in 7 days; within 6 hours	Meta for Developers	Messaging limits	12 October 2026
7 October 2025 change: first tier 1,000 to 2,000; 24 hours to 6 hours; per number to per portfolio	Meta for Developers	Upcoming changes to messaging limits	12 October 2026
Verification decision up to 14 working days	Meta Business Help Centre	Verifying your business in Meta Business Suite	12 October 2026
Partner-led verification: average 5 minutes, several hours, 3 submissions	Meta for Developers	Partner-led Business Verification	12 October 2026
Up to 2 business portfolios per person	Meta Business Help Centre	Create a business portfolio	12 October 2026
Embedded Signup: “less than five minutes”; register within 14 days	Meta for Developers	Get started as a Solution Partner	12 October 2026
Up to five Solution Partners per WhatsApp account; 250 to 6,000 templates	Meta for Developers	WhatsApp accounts and Messaging accounts	12 October 2026
2 to 20 registered numbers; number eligibility rules	Meta for Developers	Business phone numbers	12 October 2026
Deleted number available in up to 3 minutes	Meta for Developers	Migrate an existing WhatsApp number	12 October 2026
Coexistence: app version 2.24.17; 20 messages per second	Meta for Developers	Onboard WhatsApp Business app users	12 October 2026
Display name: 10 changes per 30 days; 14 days to re-register	Meta for Developers	Display names	12 October 2026
10 registration requests per 72 hours; error 133016	Meta for Developers	Register a business phone number	12 October 2026
Free tier of 1,000 service messages per number per month; payment method needed beyond it	Meta for Developers	Pricing on the WhatsApp Business Platform	12 October 2026
Webhook retries for 7 days; batches up to 1,000	Meta for Developers	Create a webhook endpoint	12 October 2026
80 and 1,000 messages per second; 1,000-per-second eligibility (unlimited limit, 100,000+ unique users in 24 hours, Medium quality); 250 ms median, 1% over 1 second; three status webhooks per outbound message	Meta for Developers	Throughput	12 October 2026
Template review up to 24 hours; appeals within 24 hours	Meta for Developers	Template review	12 October 2026
100 templates created per hour	Meta for Developers	Template fundamentals	12 October 2026
Six escalation paths for automation; opt-in limbs (a) and (b)	WhatsApp (Business Messaging Policy, updated 23 September 2026)	WhatsApp Business Messaging Policy	12 October 2026
Clause 4.7, AI Providers	Meta (Terms for WhatsApp Business Platform, modified 23 September 2026)	Meta Terms for WhatsApp Business Platform	12 October 2026
Three opt-in requirements	Meta for Developers	Get opt-in for WhatsApp	12 October 2026
Tech Provider: business verification, then App Review with two videos	Meta for Developers	Become a Tech Provider	12 October 2026
Calling API prerequisite: daily messaging limit of at least 2,000 unique recipients	Meta for Developers	Cloud API Calling	12 October 2026
AI books 40+ meetings/week for many teams	Zian (first-party)	zian.ai	12 October 2026
LeadsNow.ai: under 60 seconds, 24/7; pay-per-result	LeadsNow.ai (first-party)	leadsnow.ai	12 October 2026