Description
What is Meta App Review?
Meta App Review is the process through which Meta checks that an app uses the platform's permissions in an approved way before granting it Advanced Access to them. For WhatsApp it is the gate between building on your own account and serving customers. Business-type apps receive Standard Access to WhatsApp permissions automatically, which works on assets the app's own business owns; acting on WhatsApp Business Accounts (WABAs) owned by other businesses requires Advanced Access, and Advanced Access requires passing App Review.
A submission is made per permission in the App Dashboard. For whatsapp_business_messaging, Meta asks for a description of the messaging features you offer onboarded clients and a screen recording of your app sending a message that then appears in the recipient's WhatsApp client. For whatsapp_business_management, it asks how you use the permission on clients' assets and for a recording of your app, or WhatsApp Manager, creating a message template. Each permission gets its own description and its own recording — Meta warns against one video covering several use cases — and screenshots are not accepted.
App Review sits in a sequence of checks. The business that owns the app completes business verification, which confirms the legal entity; App Review then approves the app's use of each permission; Tech Providers also complete access verification before onboarding customers at scale. Turnaround varies and is not guaranteed — often a few days — and you can start App Review before Embedded Signup is fully built. A direct developer sending only for its own brand does not need App Review at all.
Key takeaways
- Meta App Review checks how an app uses each permission and grants Advanced Access, which it needs to act on other businesses' WABAs.
- Direct developers using only their own business's assets do not need App Review; Tech Providers and Solution Partners do.
- Each permission needs its own written use case and its own screen recording; Meta does not accept screenshots.
- Reviews often finish within days but have no guaranteed turnaround; unnecessary permissions are a common reason for rejection.
- App Review approves the app's use of data; business verification, a separate check, confirms the company behind it.
Mechanics
How does Meta App Review work?
step 1 — Confirm you need it
If your app only touches your own business's WABA, Standard Access is enough. If customers will connect their WABAs to your app, plan for App Review.
step 2 — Prepare the business and the app
Complete business verification for the portfolio that owns the app, and give the Business-type app a privacy policy URL, an icon and a category.
step 3 — Build the flow you will show
Implement a working path for each permission — sending a message from your interface for messaging, creating a template for management — and make successful test calls with each.
step 4 — Write and record per permission
Describe which feature uses the permission and why, then record that feature end to end, including the message arriving on a phone.
step 5 — Submit and respond
Submit from the App Dashboard's App Review section; drafts are not reviewed. If rejected, read the reviewer's notes, fix the specific gap and resubmit.
step 6 — Stay compliant after approval
Keep requested permissions matched to live features and complete Meta's periodic data-use checks when the App Dashboard asks for them.
Why it matters
Why does Meta App Review matter?
Without Advanced Access, customers cannot grant your app the permission through Embedded Signup, and calls on their WABAs fail with error 200: the whole partner business model stalls. A clean first submission saves days of back-and-forth. Rejections usually trace back to vague descriptions, recordings that do not show the permission in use, or permissions requested for features that do not exist yet.
Properties
Meta App Review: key facts and limits
- Who needs it
- Apps acting on other businesses' WABAs
- What it grants
- Advanced Access, per permission
- Not needed for
- Direct developers on their own assets
- Per permission
- One written description and one screen recording
- Screenshots
- Not accepted
- Turnaround
- Varies; no guaranteed time
- Without approval
- Error 200 on clients' WABAs
- Common rejection
- Unnecessary permissions requested
Caveats
Common mistakes with Meta App Review
Requesting permissions for future features
Meta names unnecessary permissions as a common rejection reason. Request only what a working feature uses today and add the rest when it ships.
One video for everything
Meta warns against a single recording that covers several permissions. Record each permission's use case separately, end to end.
Recordings that stop at the API
For messaging, the reviewer needs to see the message arrive in a WhatsApp client, not just a 200 response. Show both ends of the send.
Leaving the submission in draft
Drafts are not reviewed. Confirm the status changed to submitted, and watch the App Dashboard for questions from the reviewer.
Confusing it with business verification
Verification confirms your company; App Review approves your app's use of data. Partners need both, and one never substitutes for the other.
Example
Example: A Kolkata Tech Provider's first submission
A Kolkata start-up building a WhatsApp helpdesk for clinics submits whatsapp_business_messaging and whatsapp_business_management together, plus business_management "for later". The review comes back rejected: one video showed both features, and nothing in the app used business_management. On the second attempt the team drops business_management, records one video per permission — a receptionist's reply arriving on a patient's phone, and a reminder template being created in their dashboard — and writes two short, specific descriptions. Both permissions are approved the next day, and the first clinic completes Embedded Signup that afternoon.
Usage
Meta App Review in code
# whatsapp_business_messaging: the send your recording should show arriving on a phonecurl -X POST "https://graph.facebook.com/v26.0/{PHONE_NUMBER_ID}/messages" \-H "Authorization: Bearer {ACCESS_TOKEN}" \-H "Content-Type: application/json" \-d '{"messaging_product": "whatsapp","to": "{YOUR_TEST_NUMBER}","type": "template","template": { "name": "hello_world", "language": { "code": "en_US" } }}'
Meta's API Setup panel in the App Dashboard can generate a request like this for your test number.
Notes
Best practices for Meta App Review
- Write descriptions from the customer's point of view: who uses the feature, what they do and why the permission is needed.
- Use a clean test account with realistic sample data in recordings, and caption each step.
- Start App Review while you finish Embedded Signup; Meta says you do not have to wait for it.
- Keep your recordings — you will need them again when you request a new permission.
Questions
Meta App Review FAQs
- Do I need Meta App Review to use the WhatsApp Cloud API?
- Only if your app will act on other businesses' WhatsApp accounts. A direct developer sending for its own business uses Standard Access, which needs no App Review.
- How long does Meta App Review take?
- There is no guaranteed turnaround; many reviews finish within a few days. Rejections and resubmissions add time, so a precise first submission is the fastest route to approval.
- Why was my Meta App Review rejected?
- Usually because the recording did not show the permission in use, one video covered several permissions, or the app asked for permissions it does not need. The reviewer's notes in the App Dashboard name the specific gap.
- What is the difference between App Review and business verification?
- Business verification confirms the legal entity behind your Meta business portfolio; App Review approves how your app uses each permission. Partners usually need both, and Tech Providers also complete access verification.