How to get your own WhatsApp Business API credentials

Why go direct instead of through a BSP

Almost every guide to this subject is published by a Business Solution Provider, and they share one commercial interest: that you route your WhatsApp through them. The model is a monthly platform fee plus a markup on every message on top of Meta’s wholesale rate — entry plans in India commonly run from roughly ₹1,000 to ₹2,500 a month before a single message is sent, and the per-message markup on top is typically in the low double digits of a percent, sometimes far more.

That is why those same guides describe going direct as weeks of engineering work. It is not. The work above is an hour of form-filling plus Meta’s verification queue, and at the end you hold the assets: the WABA is in your Business account, the number is registered to you, and the token is yours to revoke. If you leave 399Apps tomorrow, your WhatsApp Business account stays exactly where it is.

• • The WABA, the number and the templates belong to your Meta Business account, not to us
• • Meta bills your business directly at Meta’s own published rates
• • 399Apps takes no per-message cut and is not your BSP
• • Revoking the token in Meta instantly cuts our access, with nothing to cancel on our side

The number is where most setups fail

Meta will not register a number that is currently in use on consumer WhatsApp or on the free WhatsApp Business app. This catches almost everyone, because the number a business wants to use is usually the number it has been messaging customers from for years.

You have two clean options. Delete the existing WhatsApp account on that number from inside the app (Settings → Account → Delete my account), wait for it to fully clear, then register it — you lose that chat history, so export anything you need first. Or register a second number for the API and keep the old one for one-to-one chat. Plenty of businesses run both deliberately: a human number for conversations and an API number for invoices, receipts and reminders.

• • The number cannot be live on consumer WhatsApp or the WhatsApp Business app
• • Deleting that account is irreversible and takes the chat history with it
• • Any Indian operator works; a landline works if it can receive a voice call
• • A number registered to the API can no longer be used in the normal WhatsApp app

Use a permanent System User token, not the one on the dashboard

The API Setup page offers a temporary access token right next to the IDs you need, and it is the obvious thing to copy. It expires in 24 hours. Paste that one and your integration works beautifully for a day and then stops, usually on a morning when you are billing.

The token that belongs in production is generated against a System User in Business Settings with the expiry set to Never, carrying the whatsapp_business_messaging and whatsapp_business_management permissions. Meta displays it once, so store it somewhere safe before you close the dialog. In 399Apps it is encrypted at rest and never shown back to you — the field stays masked, and leaving it blank when you edit anything else keeps the saved token untouched.

The App Secret is what makes opt-out work

It is tempting to skip the App Secret, because messages go out fine without it. They do — what breaks is everything coming back. Meta signs every inbound webhook with the App Secret, and without it we cannot tell a genuine STOP from a forged one, so we refuse all of them.

That matters more than it sounds. A forged STOP would suppress a real paying customer permanently and you would have no way to undo it, so the safe behaviour is to fail closed and ignore inbound entirely until the secret is set. The cost of that safety is real: a customer who types STOP and keeps receiving messages reports the number, and a reported number is how businesses lose WhatsApp access altogether.

• • Without the App Secret, every inbound message is discarded — including STOP
• • With it, STOP suppresses that contact and we send an acknowledgement back
• • The same webhook carries delivery and read receipts, so send reports stop being guesses
• • The App Secret is on App Settings → Basic, not on the WhatsApp screens

What it costs

The WhatsApp Business API connection is a free add-on included with any paid 399Apps subscription — there is no separate WhatsApp plan, no per-user charge and no monthly platform fee from us. Messages are billed by Meta, to your business, at Meta’s own published rates, on the payment method attached to your Meta Business account. We never see that bill and we take nothing from it.

Meta prices per template message and rates differ by category — utility and authentication messages (an invoice, a payment receipt, an OTP) cost a fraction of a rupee each in India, while marketing messages cost meaningfully more. Because there is no markup in between, the invoice you send a customer costs you what Meta charges for it and nothing else. Compare that to a platform fee plus a percentage on every message and the difference compounds with every bill you raise.

• • The connection: free with any paid 399Apps subscription
• • The messages: billed by Meta directly to you, at Meta’s rates
• • 399Apps markup: none, on any message, at any volume
• • Meta’s published rate card is the one to check before you budget — it changes

What WhatsApp will not let you do, whatever a vendor promises

These are Meta’s platform rules, not one vendor’s limitations, and a provider who implies otherwise is setting you up to lose your number. A business cannot start a conversation with free-form text. Anything you initiate has to be a template Meta approved in advance, and template review takes minutes to a day.

Free-form replies are allowed only inside the 24-hour window that a customer’s own message opens. Recipients must have given you their number in a context where messaging them is expected — uploading a scraped list is the fastest route to a blocked number. And opt-out is not optional: STOP has to work, which is exactly why the App Secret is part of the setup rather than a nice-to-have.

• • Business-initiated messages must use a pre-approved template
• • Free-form text only inside the 24-hour window a customer’s reply opens
• • No cold broadcasting to numbers that did not opt in
• • A high block rate lowers your quality rating and can cost you the number

You may not need the API at all

If all you want is to send a customer their invoice PDF from your own phone, the Cloud API is more machinery than the job needs. Every 399Apps account includes a wa.me quick send: pick the customer, the message is built in your browser, WhatsApp opens with it ready, you press send. No Meta account, no verification, no templates, nothing to set up — and nothing leaves your browser, because we never see the message.

The Cloud API earns its setup when sending has to happen without a human present: payment reminders that go out on schedule, receipts that follow a POS sale automatically, booking confirmations, delivery updates, or one message to two hundred customers. That is the line. If a person is going to tap send every time anyway, start with quick send and come back to this page when you outgrow it.