Updated on October 25, 2026
Securing a business account on the WhatsApp Business API involves four layers: the phone number’s two-step verification PIN, two-factor authentication and permissions for everyone with access to your Meta business portfolio, your system’s tokens and webhooks, and staying alert to fake support scams. Most incidents do not come from a technical flaw at Meta but from a leaked credential, a former employee’s forgotten access, or someone clicking a “Meta Support” link. This guide shows what to configure at each layer.
The layers that need protecting
| Layer | What an attacker can do | Main protection |
|---|---|---|
| Phone number | Register your number elsewhere and receive your messages | Two-step verification PIN |
| Meta business portfolio | Add people, change the payment method, edit templates and numbers | Mandatory 2FA, few admins, access reviews |
| API tokens | Send messages as your business and read data | Least-privilege token, stored in a vault, revocable |
| Webhook | Inject fake events into your system | Signature validation, HTTPS, non-obvious URL |
| Support dashboard | Read customer conversations | Individual logins, per-queue permissions, fast offboarding |
| Phone (with coexistence) | Reply as the business from the app | Two-step verification in the app, review of linked devices |
The number’s two-step verification PIN
Every number on the Cloud API has, or can have, a six-digit PIN. According to Meta’s two-step verification documentation, it is then required to register the number. In practice, it is what stops someone who obtained your SMS verification code from registering your number on another account or provider.
To set or change the PIN through the API:
curl -X POST "https://graph.facebook.com/v26.0/PHONE_NUMBER_ID" \
-H "Authorization: Bearer $META_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "pin": "583920" }'A successful call returns {"success": true}. Key points from the documentation:
- There is no endpoint to disable two-step verification.
- Forgot the PIN? You can reset it in WhatsApp Manager, under the number’s settings, in the two-step verification tab, with the change PIN option.
- The PIN is being deprecated for eligible Cloud API numbers, with a gradual rollout. For numbers that are already eligible, the two-step verification tab no longer appears in WhatsApp Manager. As long as the tab is there, the PIN applies to your number.
PIN best practices:
- No
123456, founding dates or the last digits of your company registration number. - Keep it in the company password manager, not in the team spreadsheet.
- Change it when someone who knew it leaves your company or your vendor.
- The PIN is only needed at registration. If a vendor asks for it outside a migration you started, be suspicious.
If you plan to free up a number already on WhatsApp, you will need the PIN at registration time. To switch providers, you now share your WhatsApp account with the new partner instead of migrating the number; even so, document the PIN beforehand in case it is requested.
Business portfolio: who can access what
The business portfolio (formerly Business Manager) is the key to everything: numbers, templates, payment method, business verification. Meta’s Business Help Center says two-factor authentication is already required for portfolios that are 90 days or older and recommends requiring it for everyone with access. You will find it in the Security Center, inside business settings.
What to configure:
- Require 2FA for everyone, not just admins. Prefer an authenticator app or a passkey over SMS.
- More than one admin, but few admins. Meta recommends having more than one person with full control, so the portfolio is not orphaned if someone leaves. But every extra admin is another door.
- Partial access for day-to-day work. People who only create templates or monitor numbers do not need full control.
- System users for integrations. Integration tokens should belong to a system user, not to a developer’s personal account. See permanent token with a system user.
- Periodic review. Once a quarter, list people, partners and system users and remove anything without an owner.
- Same-day offboarding. People who leave lose access to the portfolio, the support dashboard and password vaults on their last day.
Tokens and webhooks
On the official API, whoever holds the token can send messages as your business. Treat it like a bank password:
- Environment variable or secrets vault, never in code or the repository.
- Least privilege. One token per integration, limited to the number it uses.
- Fast revocation. Know where to revoke it and test the procedure before you need it.
- Rotation. Replace it when someone with access leaves or when you suspect a leak.
On the webhook side, the risk is someone posting fake events to your URL. If you receive webhooks directly from Meta, validate the X-Hub-Signature-256 header: Meta signs the payload with SHA-256 using your app secret, according to the Graph API webhooks documentation.
import crypto from 'node:crypto';
export function isValidSignature(rawBody, header, appSecret) {
const expected = 'sha256=' + crypto.createHmac('sha256', appSecret).update(rawBody).digest('hex');
const a = Buffer.from(expected);
const b = Buffer.from(header || '');
return a.length === b.length && crypto.timingSafeEqual(a, b);
}Use the raw request body, before any JSON.parse, or the signature will not match. Also: HTTPS only, a URL with a hard-to-guess random segment, and no sensitive action (such as a refund) triggered by an event alone without a check.
The most common scams against business accounts
Scams change their costume but follow a few scripts:
| Scam | How it arrives | What to do |
|---|---|---|
| Fake Meta support | Message or email saying the account will be disabled, with a link to “appeal” | Do not click. Check the account by going to Meta directly, typing the address in your browser |
| Malicious partner request | Partner invitation to your portfolio with a phishing link, sent from a legitimate Meta domain | Do not click links in invitations from people or businesses you do not know |
| Verification code request | “I sent you a code by mistake, can you forward it?” | Never pass on an SMS or voice code. With the code and no PIN, the number can be stolen |
| Green badge offer | “We guarantee the verified badge in 48 hours, we just need access” | The badge is granted by Meta, not sold by third parties |
| Fake vendor | “Update your token/PIN on this form” | Your API provider does not need the PIN outside a migration you requested |
Two points from Meta are worth keeping as rules of thumb. First, Meta advises not replying to messages that ask for your password or credit card details. Second, Meta warns about portfolio partner requests carrying phishing links that come from facebookmail.com, a legitimate domain; in other words, checking the sender is not enough. Suspicious emails can be reported to phish@fb.com.
If the account has already been compromised
- Change passwords and turn on 2FA for everyone with portfolio access; remove unknown sessions and devices.
- Review people, partners and system users in the portfolio and remove anything you do not recognize.
- Revoke all API tokens and issue new ones.
- Change the number’s PIN in WhatsApp Manager.
- Check templates, numbers and the payment method for changes.
- Assess the impact on customer data. In Brazil, if there is relevant risk to data subjects, the LGPD (the national data protection law) requires notifying the ANPD and the people affected. See LGPD and WhatsApp.
Coexistence: the phone is also a way in
With coexistence, the number runs on the WhatsApp Business app and the API at the same time. Whoever holds the phone replies as the business. Turn on two-step verification in the app itself, review linked devices often and decide who may use the phone. In the support dashboard, keep individual logins and per-queue permissions, as in multi-agent support with the API.
How to do this with Vectalk
With Vectalk, your integration uses Vectalk’s own tokens, so Meta credentials are not exposed in your application. According to the token documentation, each token is stored as a hash, remains valid until revoked, and can be an organization or an instance token; prefer instance tokens to limit scope. List and revoke tokens under Settings → API Tokens or through the API (GET and DELETE on /api/auth/api-tokens). Number registration accepts the PIN at POST /api/phone-numbers/register. To get started, create an account at apps.vectalk.com.br/register; for account questions, see the Help Center.
Frequently asked questions
Is the API PIN the same as the app’s two-step verification?
They do a similar job: both protect the number’s registration. The Cloud API PIN is set through the API or WhatsApp Manager and is requested when the number is registered on the platform.
Can I turn off the number’s PIN on the API?
Meta’s documentation says there is no endpoint to disable two-step verification. You can change the PIN through the API or reset it in WhatsApp Manager. For eligible numbers, Meta is phasing out the PIN gradually.
How many admins should the portfolio have?
Meta recommends more than one person with full control, so the portfolio is never left without an owner. Beyond that, fewer is better: give partial access to people who only operate.
I got a message from “Meta” saying my account will be disabled. Is it real?
Treat it as suspicious. Do not click the link; go to Meta by typing the address in your browser and check your account there. Meta advises not replying to messages that ask for passwords or card details.
What should I do if a token leaks?
Revoke it immediately, issue a new one, update the integration and review the messages sent during that period to understand what it was used for.
Official sources consulted on October 25, 2026: Phone number two-step verification, Business portfolio Security Center, Require two-factor authentication in your portfolio, Avoid scams and phishing (Meta), Check if an email is really from Meta, Graph API webhooks: payload validation, Vectalk docs: API tokens, Vectalk docs: register number.