{"id":135,"date":"2026-10-25T12:58:16","date_gmt":"2026-10-25T12:58:16","guid":{"rendered":"https:\/\/vectalk.com.br\/blog\/whatsapp-api-permanent-access-token\/"},"modified":"2026-10-25T13:09:47","modified_gmt":"2026-10-25T13:09:47","slug":"whatsapp-api-permanent-access-token","status":"publish","type":"post","link":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/","title":{"rendered":"Permanent WhatsApp Business API access token with a system user"},"content":{"rendered":"\n<p><em>Updated on October 25, 2026<\/em><\/p>\n\n\n\n<p>A permanent WhatsApp Business API access token is a <strong>system user<\/strong> access token, created in your Meta business portfolio settings with the <code>whatsapp_business_messaging<\/code>, <code>whatsapp_business_management<\/code> and <code>business_management<\/code> permissions. When you generate it, you choose whether it never expires or lasts 60 days and must be refreshed. This is the token that belongs in production, instead of the temporary token from the app dashboard, which expires within hours.<\/p>\n\n\n\n<p>This guide covers the steps in the dashboard, the assets the system user needs, how to generate, refresh and revoke the token through the API, and the security practices that go with it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The three WhatsApp API token types<\/h2>\n\n\n\n<p>Meta&#8217;s <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/access-tokens\" target=\"_blank\" rel=\"noreferrer noopener\">access tokens documentation<\/a> lists three types:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Type<\/th><th>Who it is for<\/th><th>Lifetime<\/th><\/tr><\/thead><tbody><tr><td>User access token<\/td><td>Development and testing; the one shown in the app&#8217;s &#8220;API Setup&#8221; panel<\/td><td>Expires quickly and must be regenerated every few hours<\/td><\/tr><tr><td>System user access token<\/td><td>A business accessing its own data, direct integration<\/td><td>Long-lived; never expires or 60 days, depending on what you choose<\/td><\/tr><tr><td>Business Integration System User access token<\/td><td>Tech Providers and partners onboarding customers through Embedded Signup<\/td><td>Obtained by exchanging the Embedded Signup code<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>If you integrate your own business directly with the Cloud API, you need the second one. When your system starts returning error <code>190<\/code> (token expired) or <code>0<\/code> (could not authenticate) a few hours after going live, the temporary token almost always ended up in production. These codes are covered in <a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-error-codes\/\">WhatsApp API errors<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Before you start<\/h2>\n\n\n\n<p>You will need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>admin access to the business portfolio (formerly Business Manager);<\/li>\n\n\n<li>an app in the Meta developer dashboard with the WhatsApp product added;<\/li>\n\n\n<li>the WhatsApp Business Account (WABA) and phone number already set up in the portfolio.<\/li>\n\n<\/ul>\n\n\n\n<p>If you are not there yet, <a href=\"https:\/\/vectalk.com.br\/blog\/en\/how-to-get-whatsapp-api-access\/\">how to get access to the WhatsApp API<\/a> covers the portfolio, app, WABA and number.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step by step: create the system user and generate the token<\/h2>\n\n\n\n<p>These steps follow Meta&#8217;s official documentation. Menu names may vary slightly by language and Meta Business Suite version.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open your portfolio&#8217;s <strong>Business settings<\/strong> and click <strong>System users<\/strong>.<\/li>\n\n\n<li>Click <strong>+ Add<\/strong>, enter a name (e.g. <code>whatsapp-integration-prod<\/code>) and choose the <strong>Employee<\/strong> or <strong>Admin<\/strong> role.<\/li>\n\n\n<li>Click the new system user&#8217;s name, then <strong>Assign assets<\/strong>.<\/li>\n\n\n<li>Select your app, grant the <strong>Manage app<\/strong> permission and confirm.<\/li>\n\n\n<li>Reload the page until the app shows <strong>Full control<\/strong>. Meta notes the assignment can take a few minutes.<\/li>\n\n\n<li>Still on the system user, click <strong>Generate token<\/strong>, select the app and choose the expiration preference.<\/li>\n\n\n<li>Select the three permissions: <code>business_management<\/code>, <code>whatsapp_business_management<\/code> and <code>whatsapp_business_messaging<\/code>.<\/li>\n\n\n<li>Click <strong>Generate token<\/strong> and copy the value. It is shown only once.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Don&#8217;t forget access to the WhatsApp account<\/h3>\n\n\n\n<p>Generating the token with the right permissions is not enough. The system user also needs <strong>Partial<\/strong> or <strong>Full<\/strong> access to the WhatsApp assets it will query. According to the documentation, many endpoints require that access on both the WhatsApp account and the linked Messaging account, and without it the API returns error code <code>200<\/code>.<\/p>\n\n\n\n<p>In Meta Business Suite, go to <strong>Settings \u2192 Accounts<\/strong>, open the WhatsApp account, select the <strong>People<\/strong> tab, click <strong>+ Add people<\/strong>, pick the system user and set the access level. Repeat for the Messaging account. Meta points out that in Business Suite an assignment does not carry over to the other account, so assign both explicitly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Employee or admin?<\/h3>\n\n\n\n<p>An admin system user has full access to every account in the portfolio by default. An employee system user only reaches what was assigned to it. For an integration, the safer choice is <strong>employee<\/strong>, with access only to the app and the WhatsApp accounts it needs. Meta&#8217;s <a href=\"https:\/\/developers.facebook.com\/docs\/marketing-api\/system-users\/overview\" target=\"_blank\" rel=\"noreferrer noopener\">system users overview<\/a> recommends one system user per access type and careful protection of the admin token, because a leaked token with a narrow scope does less damage.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Expiry: &#8220;never&#8221; or 60 days<\/h2>\n\n\n\n<p>When generating the token, Meta offers two options, described in <a href=\"https:\/\/developers.facebook.com\/docs\/business-management-apis\/system-users\/install-apps-and-generate-tokens\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install Apps, Generate, Refresh, and Revoke Tokens<\/a>:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Option<\/th><th>Validity<\/th><th>Refresh<\/th><th>When to use<\/th><\/tr><\/thead><tbody><tr><td>Non-expiring<\/td><td>Never expires based on time<\/td><td>Not needed<\/td><td>When you accept the leak risk in exchange for no refresh routine<\/td><\/tr><tr><td>Expires in 60 days<\/td><td>60 days from generation or last refresh<\/td><td>Required within the window<\/td><td>When you want to limit the impact of a leaked token. This is the option Meta marks as recommended<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>The &#8220;permanent token&#8221; name comes from the first option. It can still stop working for other reasons: the system user loses access to the app, permissions are removed, or someone revokes the token. Treat an authentication failure as something to monitor, not something impossible.<\/p>\n\n\n\n<p>With the 60-day option, if the token is not refreshed in time, it is forfeited and you need to generate a new one. Put the refresh in a scheduled job, not in a calendar reminder.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Generate, refresh and revoke via the API<\/h2>\n\n\n\n<p>Everything the dashboard does can also be done with Graph API calls, which helps when you automate rotation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Generate<\/h3>\n\n\n\n<p>The system user must have the app installed (<code>POST \/SYSTEM_USER_ID\/applications<\/code>). Then generate the token with the <code>access_tokens<\/code> endpoint, adding <code>set_token_expires_in_60_days=true<\/code> for a 60-day token:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"language-bash\">curl -X POST \"https:\/\/graph.facebook.com\/vXX.X\/SYSTEM_USER_ID\/access_tokens\" \\\n  -d \"business_app=APP_ID\" \\\n  -d \"scope=business_management,whatsapp_business_management,whatsapp_business_messaging\" \\\n  -d \"set_token_expires_in_60_days=true\" \\\n  -d \"appsecret_proof=APPSECRET_PROOF\" \\\n  -d \"access_token=CURRENT_TOKEN\"<\/code><\/pre>\n\n\n\n<p><code>appsecret_proof<\/code> is the HMAC-SHA256 of the token, keyed with the app secret. It proves the call comes from your server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"language-js\">import crypto from 'node:crypto';\n\nconst appsecretProof = crypto\n  .createHmac('sha256', process.env.META_APP_SECRET)\n  .update(process.env.META_ACCESS_TOKEN)\n  .digest('hex');<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Refresh<\/h3>\n\n\n\n<p>Refreshing uses the <code>oauth\/access_token<\/code> endpoint with <code>grant_type=fb_exchange_token<\/code>. The response contains the new <code>access_token<\/code> and <code>expires_in<\/code> in seconds:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"language-bash\">curl -G \"https:\/\/graph.facebook.com\/vXX.X\/oauth\/access_token\" \\\n  -d \"grant_type=fb_exchange_token\" \\\n  -d \"client_id=APP_ID\" \\\n  -d \"client_secret=APP_SECRET\" \\\n  -d \"set_token_expires_in_60_days=true\" \\\n  -d \"fb_exchange_token=CURRENT_TOKEN\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Revoke<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"language-bash\">curl -G \"https:\/\/graph.facebook.com\/vXX.X\/oauth\/revoke\" \\\n  -d \"client_id=APP_ID\" \\\n  -d \"client_secret=APP_SECRET\" \\\n  -d \"revoke_token=OLD_TOKEN\" \\\n  -d \"access_token=NEW_TOKEN\"<\/code><\/pre>\n\n\n\n<p>A successful response is <code>{\"success\":\"true\"}<\/code>. The <code>client_id<\/code> app must match the app of both tokens.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Zero-downtime rotation<\/h2>\n\n\n\n<p>Meta describes rotation without downtime in three steps:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Refresh:<\/strong> generate the new token. The old one keeps working until it expires.<\/li>\n\n\n<li><strong>Deploy:<\/strong> update the token in your secrets manager and redeploy or reload the configuration.<\/li>\n\n\n<li><strong>Revoke:<\/strong> only after confirming everything uses the new token, revoke the old one. Revocation takes effect immediately.<\/li>\n\n<\/ol>\n\n\n\n<p>A weekly job that checks the token&#8217;s age and refreshes it after, say, 45 days leaves room for failed deploys.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security practices<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Store it in a secrets manager or environment variable.<\/strong> Never in a repository, spreadsheet or chat message.<\/li>\n\n\n<li><strong>Do not parse the token.<\/strong> Meta asks you to treat it as an opaque value and store it in a variable-length field with no fixed maximum size.<\/li>\n\n\n<li><strong>Send it in the <code>Authorization: Bearer<\/code> header<\/strong>, never in the URL, where it ends up in logs.<\/li>\n\n\n<li><strong>Minimum scope.<\/strong> One employee system user per integration, with access only to the accounts it needs.<\/li>\n\n\n<li><strong>Protect the app secret.<\/strong> With it and a token, tokens can be refreshed and revoked.<\/li>\n\n\n<li><strong>Inspect the token<\/strong> in Meta&#8217;s access token debugger, which shows permissions and expiry.<\/li>\n\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-business-account-security\/\">WhatsApp Business account security<\/a> covers the PIN, portfolio access and scams.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How this works with Vectalk<\/h2>\n\n\n\n<p>With Vectalk, you don&#8217;t need to create a system user or manage Meta&#8217;s token. When you connect the number through Embedded Signup, Vectalk imports the <code>phone_number_id<\/code>, <code>waba_id<\/code> and access token, according to the <a href=\"https:\/\/docs.vectalk.com.br\/quickstart\">quickstart<\/a>. Your application uses a Vectalk token instead:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Organization token:<\/strong> reaches every instance and requires <code>phone_number_id<\/code> when sending.<\/li>\n\n\n<li><strong>Instance token:<\/strong> limited to one number, required for media and templates.<\/li>\n\n<\/ul>\n\n\n\n<p>Per the <a href=\"https:\/\/docs.vectalk.com.br\/concepts\/tokens\">tokens documentation<\/a>, Vectalk tokens do not expire automatically, remain valid until revoked, are shown only once and are stored as a hash. You can also create and revoke them through the API, with <code>POST \/api\/auth\/api-tokens<\/code> and <code>DELETE \/api\/auth\/api-tokens\/{id}<\/code>, described under <a href=\"https:\/\/docs.vectalk.com.br\/authentication\">Authentication<\/a>. The same rotation routine applies: create the new one, deploy, revoke the old one.<\/p>\n\n\n\n<p>To get started, create your account at <a href=\"https:\/\/apps.vectalk.com.br\/register\">apps.vectalk.com.br\/register<\/a>. The natural next step is to <a href=\"https:\/\/vectalk.com.br\/blog\/en\/send-whatsapp-message-api-examples\/\">send your first message<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Can I use the temporary token from the app dashboard in production?<\/h3>\n\n\n\n<p>No. It is a user access token meant for testing and expires within hours. For production, use a system user token.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does the permanent WhatsApp token really never expire?<\/h3>\n\n\n\n<p>If you pick the non-expiring option, it does not expire based on time. It can still be invalidated if the system user loses access to the app or its permissions, or if it is revoked.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which permissions does the token need?<\/h3>\n\n\n\n<p><code>business_management<\/code>, <code>whatsapp_business_management<\/code> and <code>whatsapp_business_messaging<\/code>. On top of that, the system user needs access to the WhatsApp account and the Messaging account.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why do I get error 200 even with the right token?<\/h3>\n\n\n\n<p>Usually because the system user was not given Partial or Full access to the WhatsApp assets. Assign both the WhatsApp account and the Messaging account to the system user.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">I lost the token. Can I see it again?<\/h3>\n\n\n\n<p>No. The token is shown only when it is generated. Generate a new one and revoke the previous one.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p><strong>Official sources consulted on October 25, 2026:<\/strong> <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/access-tokens\" target=\"_blank\" rel=\"noreferrer noopener\">Access tokens (WhatsApp Business Platform)<\/a>, <a href=\"https:\/\/developers.facebook.com\/docs\/business-management-apis\/system-users\/install-apps-and-generate-tokens\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install Apps, Generate, Refresh, and Revoke Tokens<\/a>, <a href=\"https:\/\/developers.facebook.com\/docs\/marketing-api\/system-users\/overview\" target=\"_blank\" rel=\"noreferrer noopener\">System users overview<\/a>, <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/support\/error-codes\" target=\"_blank\" rel=\"noreferrer noopener\">Cloud API error codes<\/a>, <a href=\"https:\/\/docs.vectalk.com.br\/quickstart\">Vectalk quickstart<\/a>, <a href=\"https:\/\/docs.vectalk.com.br\/concepts\/tokens\">Vectalk docs: tokens<\/a>, <a href=\"https:\/\/docs.vectalk.com.br\/authentication\">Vectalk docs: authentication<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Step by step: create a Meta system user, generate the WhatsApp Business API access token, pick the expiry and rotate it without breaking your integration.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-135","post","type-post","status-publish","format-standard","hentry","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>WhatsApp API Permanent Access Token Guide | Vectalk<\/title>\n<meta name=\"description\" content=\"How to create a permanent WhatsApp API access token with a Meta system user: permissions, assets, never vs 60-day expiry, rotation and security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WhatsApp API Permanent Access Token Guide | Vectalk\" \/>\n<meta property=\"og:description\" content=\"How to create a permanent WhatsApp API access token with a Meta system user: permissions, assets, never vs 60-day expiry, rotation and security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog Vectalk\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-25T12:58:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-25T13:09:47+00:00\" \/>\n<meta name=\"author\" content=\"wanderleyfcunha\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"wanderleyfcunha\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/\"},\"author\":{\"name\":\"wanderleyfcunha\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#\\\/schema\\\/person\\\/ff36ecd9d8257856f227f8e5d639db2b\"},\"headline\":\"Permanent WhatsApp Business API access token with a system user\",\"datePublished\":\"2026-10-25T12:58:16+00:00\",\"dateModified\":\"2026-10-25T13:09:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/\"},\"wordCount\":1414,\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/\",\"url\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/\",\"name\":\"WhatsApp API Permanent Access Token Guide | Vectalk\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#website\"},\"datePublished\":\"2026-10-25T12:58:16+00:00\",\"dateModified\":\"2026-10-25T13:09:47+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#\\\/schema\\\/person\\\/ff36ecd9d8257856f227f8e5d639db2b\"},\"description\":\"How to create a permanent WhatsApp API access token with a Meta system user: permissions, assets, never vs 60-day expiry, rotation and security.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/whatsapp-api-permanent-access-token\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Permanent WhatsApp Business API access token with a system user\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/\",\"name\":\"Blog Vectalk\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#\\\/schema\\\/person\\\/ff36ecd9d8257856f227f8e5d639db2b\",\"name\":\"wanderleyfcunha\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g\",\"caption\":\"wanderleyfcunha\"},\"sameAs\":[\"https:\\\/\\\/vectalk.com.br\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WhatsApp API Permanent Access Token Guide | Vectalk","description":"How to create a permanent WhatsApp API access token with a Meta system user: permissions, assets, never vs 60-day expiry, rotation and security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/","og_locale":"en_US","og_type":"article","og_title":"WhatsApp API Permanent Access Token Guide | Vectalk","og_description":"How to create a permanent WhatsApp API access token with a Meta system user: permissions, assets, never vs 60-day expiry, rotation and security.","og_url":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/","og_site_name":"Blog Vectalk","article_published_time":"2026-10-25T12:58:16+00:00","article_modified_time":"2026-10-25T13:09:47+00:00","author":"wanderleyfcunha","twitter_card":"summary_large_image","twitter_misc":{"Written by":"wanderleyfcunha","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/#article","isPartOf":{"@id":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/"},"author":{"name":"wanderleyfcunha","@id":"https:\/\/vectalk.com.br\/blog\/#\/schema\/person\/ff36ecd9d8257856f227f8e5d639db2b"},"headline":"Permanent WhatsApp Business API access token with a system user","datePublished":"2026-10-25T12:58:16+00:00","dateModified":"2026-10-25T13:09:47+00:00","mainEntityOfPage":{"@id":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/"},"wordCount":1414,"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/","url":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/","name":"WhatsApp API Permanent Access Token Guide | Vectalk","isPartOf":{"@id":"https:\/\/vectalk.com.br\/blog\/#website"},"datePublished":"2026-10-25T12:58:16+00:00","dateModified":"2026-10-25T13:09:47+00:00","author":{"@id":"https:\/\/vectalk.com.br\/blog\/#\/schema\/person\/ff36ecd9d8257856f227f8e5d639db2b"},"description":"How to create a permanent WhatsApp API access token with a Meta system user: permissions, assets, never vs 60-day expiry, rotation and security.","breadcrumb":{"@id":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-api-permanent-access-token\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/vectalk.com.br\/blog\/"},{"@type":"ListItem","position":2,"name":"Permanent WhatsApp Business API access token with a system user"}]},{"@type":"WebSite","@id":"https:\/\/vectalk.com.br\/blog\/#website","url":"https:\/\/vectalk.com.br\/blog\/","name":"Blog Vectalk","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/vectalk.com.br\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/vectalk.com.br\/blog\/#\/schema\/person\/ff36ecd9d8257856f227f8e5d639db2b","name":"wanderleyfcunha","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g","caption":"wanderleyfcunha"},"sameAs":["https:\/\/vectalk.com.br\/blog"]}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts\/135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/comments?post=135"}],"version-history":[{"count":2,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts\/135\/revisions"}],"predecessor-version":[{"id":391,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts\/135\/revisions\/391"}],"wp:attachment":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/media?parent=135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/categories?post=135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/tags?post=135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}