WhatsApp Cloud API integration

Credential responsibilities

Receiving requires appSecret and verifyToken. verifyToken handles the GET hub.challenge handshake; appSecret verifies the X-Hub-Signature-256 signature on POST requests. Sending requires accessToken and phoneNumberId. The server derives the callback URL shown read-only in Console; it is not the sending API address.

Configuration and validation

1. Prepare a WhatsApp application, business phone number and permissions on Meta. Deploy a publicly reachable callback service.
2. Create a WhatsApp account in Console, assign its group and set appSecret and verifyToken. Add accessToken and phoneNumberId for replies.
3. Set the Webhook URL on Meta to the callback URL from Console and use the same verifyToken. Complete verification and subscribe to the required WhatsApp message events.
4. Send a message from a real user, check the Desk inbox and validate a text reply within platform conversation rules. API version and base URL are server deployment configuration, not an editable channel account URL.

Common boundaries

A successful GET handshake does not prove POST signature validation works: check verifyToken and appSecret separately. Receiving messages does not prove the access token has sending permissions or that a reply satisfies Meta’s conversation window and account policies. A saved phoneNumberId cannot be reassigned; create a new channel account for another number.

References

Meta WhatsApp Cloud API documentation ↗ · DuDu configuration fields ↗. Console has no OAuth wizard and does not replace Meta authorization, review or account provisioning.