Skip to content

A glossary story9 chapters · 6 min read

Business Integration System User Access Token(BISUAT)

The business token a Tech Provider gets by exchanging an Embedded Signup code, scoped to the WhatsApp assets one onboarded customer chose to share.

Also called: Business token · Business integration token · Embedded Signup token · BISU token

Reviewed

Follow along

Follow an Embedded Signup code until it becomes a token

9 / 9
  • Customerin Embedded Signup
  • Your pageJavaScript SDK
  • Your serverholds the app secret
  • Graph APIgraph.facebook.com

Step 9 of 9Response

Graph APIYour server

success: true

The number can send. The customer still adds a payment method in WhatsApp Manager.

  • Request — solid arrow — a call that expects an answer
  • Response — dashed arrow — the answer coming back
  • Event — dotted arrow — something happened and is pushed out
  • Async — double head — fire-and-forget, nobody waits
From the customer's last click to a registered number: watch the 30-second code travel to your server, become a business token and finish onboarding. Step through each message and its note.

Step 9 of 9: Graph API to Your server — success: true. The number can send. The customer still adds a payment method in WhatsApp Manager.

Chapter 1 · The scenario

Example: A Jaipur booking platform loses its first codes

A Jaipur Tech Provider building WhatsApp booking for salons launches Embedded Signup, and its first three customers complete the flow but never appear as connected. Its logs show /oauth/access_token failing: the frontend posted the code to a job queue that ran about two minutes later, long after the 30-second lifetime. The team moves the exchange into the HTTP handler that receives the code, so it runs within a second, and queues only the slower follow-up work. A Pune salon chain then onboards cleanly: the token comes back, debug_token shows whatsapp_business_messaging and whatsapp_business_management on the chain's WABA ID, subscribed_apps returns success: true, the number registers, and the first appointment reminder is sent that evening.

— A Jaipur booking platform loses its first codes

Chapter 2 · What is a business integration system user access token?

A business integration system user access token (BISUAT, usually just called a business token) is the credential a Tech Provider or Solution Partner (a Business Solution Provider, or BSP) receives for each business it onboards through Embedded Signup. When the customer finishes the flow, Embedded Signup returns an exchangeable code to the page that launched it, together with the customer's waba_id, phone_number_id and business_id. Your server swaps that code for the token in a server-to-server call to GET /oauth/access_token with your client_id (app ID), client_secret (app secret) and the code. Meta gives the code a time-to-live of 30 seconds, so the exchange has to happen straight away.

What makes the token distinctive is its scope. It is tied to one onboarded customer, not to your own business and not to the person who clicked through signup, so Meta describes it as letting partners act on a customer's accounts without relying on an app user's input or future re-authentication. Its API permissions are the ones your Facebook Login for Business configuration requested, typically whatsapp_business_messaging and whatsapp_business_management, and its reach is limited to the WhatsApp Business Account (WABA) and phone number the customer selected. A partner with 300 customers therefore holds 300 business tokens, one per customer, each able to touch only that customer's assets. The expiry follows the token setting in your Login for Business configuration, and access ends if the customer removes your app.

It is easy to confuse with a system user access token. A business generates a system user access token for its own portfolio, in Business Settings or through the Business Management API, and that is what a direct developer uses. Business tokens exist only for partners: Meta tells Tech Providers to use them for customer data, and Solution Partners to use them for everything except sharing their credit line, which still needs the partner's own system user token. Business tokens also require Embedded Signup configured with Facebook Login for Business; a setup based on plain Facebook Login, which Meta does not recommend, has to fall back to system user tokens.

Key takeaways

  • A business integration system user access token is the per-customer credential a Tech Provider receives when a business completes Embedded Signup.
  • Your server exchanges the Embedded Signup code at GET /oauth/access_token with client_id, client_secret and code; the code lives for 30 seconds.
  • The token reaches only the assets that customer shared, with the permissions your Facebook Login for Business configuration requested.
  • Tech Providers use business tokens for all customer calls; Solution Partners use their own system user token only to share a credit line.
  • After the exchange, subscribe your app to the customer's WABA, register the number and confirm the scopes with debug_token.

Chapter 3 · How it unfolds

How does a business integration system user access token work?

  1. Configure Embedded Signup for business tokens

    Create a Facebook Login for Business configuration that requests the WhatsApp permissions your product uses and the token expiry you want, and launch Embedded Signup with its configuration ID.

  2. Capture the code and the IDs

    When the customer finishes, the login callback returns the code and the session event returns waba_id, phone_number_id and business_id. Post all of them to your backend at once.

  3. Exchange within 30 seconds

    From the server, call GET https://graph.facebook.com/v26.0/oauth/access_token?client_id={APP_ID}&client_secret={APP_SECRET}&code={CODE}. The response carries the business token as access_token.

  4. Store it per customer and check it

    Encrypt the token and key it by the customer's business and WABA IDs. Run debug_token and confirm granular_scopes[].target_ids contains the WABA the customer meant to share.

  5. Finish onboarding with the token

    POST /{WABA_ID}/subscribed_apps so that customer's webhooks reach your app, then POST /{PHONE_NUMBER_ID}/register with a 6-digit PIN. The customer still adds a payment method in WhatsApp Manager.

Chapter 4 · In code

A business integration system user access token in code

app.post("/embedded-signup/complete", async (req, res) => {
  const { code, waba_id, phone_number_id, business_id } = req.body;
 
  // The code lives for 30 seconds: exchange it now, not from a queue
  const url = new URL("https://graph.facebook.com/v26.0/oauth/access_token");
  url.searchParams.set("client_id", process.env.META_APP_ID);
  url.searchParams.set("client_secret", process.env.META_APP_SECRET);
  url.searchParams.set("code", code);
 
  const data = await (await fetch(url)).json();
  if (!data.access_token) return res.status(502).json({ error: data.error?.message });
 
  // One encrypted secret per customer, keyed by their IDs
  await vault.put("wa/" + business_id + "/" + waba_id, data.access_token);
  await jobs.add("finish-onboarding", { business_id, waba_id, phone_number_id });
  return res.json({ connected: true });
});

Exchange synchronously in the request that receives the code; queue only the follow-up calls.

Chapter 5 · Why it matters

Why does a business integration system user access token matter?

The business token is the key a partner platform holds to every customer's WhatsApp account. Getting it right means onboarding finishes in one sitting: the customer clicks through Embedded Signup, your backend exchanges the code, subscribes to webhooks and registers the number, and the first message goes out the same afternoon. Getting it wrong means expired codes and customers asked to repeat signup, or a single shared credential whose leak would expose every tenant at once. Per-customer tokens keep the blast radius of a leak to one customer and make offboarding a matter of deleting one secret.

Chapter 6 · Where it goes wrong

Common mistakes with a business integration system user access token

  • Exchanging the code too late

    The code expires 30 seconds after Embedded Signup returns it. A queue, a retry loop or a manual step in between loses it, and the customer has to sign up again. Exchange it in the request that receives it.

  • Exchanging in the browser

    The exchange needs your app secret, which must never reach client code. Post the code to your backend and call /oauth/access_token from there.

  • Reusing one token across customers

    Using your own system user token, or one customer's business token, on another customer's WABA fails with permission errors at best and mixes tenants at worst. Look up the token by the customer's IDs on every call.

  • Stopping after the exchange

    A token alone does not finish onboarding. Without subscribed_apps you receive no webhooks for that customer, without register the number cannot send, and without a payment method the customer is not fully onboarded.

  • Trusting the selection without checking

    Customers sometimes create a second WABA during signup and share the wrong one. Compare debug_token's target_ids with the waba_id you received before you mark the customer as live.

Chapter 7 · The facts

A business integration system user access token: key facts and limits

Issued byExchanging the Embedded Signup code
Exchange callGET /oauth/access_token (client_id, client_secret, code)
Code lifetime30 seconds
ScopeOne customer's shared WABA and number
PermissionsAs requested by your Login for Business configuration
Required setupEmbedded Signup with Facebook Login for Business
Solution Partner exceptionCredit-line sharing uses your own system user token
Verifydebug_token → granular_scopes[].target_ids

Chapter 8 · BISUAT FAQs

BISUAT FAQs

What is a business token in WhatsApp Embedded Signup?+
It is the business integration system user access token your app receives for a customer who completes Embedded Signup. You get it by exchanging the code Embedded Signup returns, and it can act only on the WhatsApp assets that customer shared.
How long is the Embedded Signup code valid?+
Thirty seconds. Meta gives the exchangeable code a 30-second time-to-live, so your server must call /oauth/access_token as soon as the code arrives; an expired code means the customer has to repeat signup.
What is the difference between a business integration token and a system user access token?+
A business integration token is issued to a partner for one onboarded customer's assets; a system user access token is generated by a business for its own portfolio. Direct developers use system user tokens, Tech Providers use business tokens.
Do business integration system user access tokens expire?+
Their expiry follows the token setting in your Facebook Login for Business configuration, and access ends whenever the customer removes your app. Check `expires_at` with debug_token and alert on error 190 either way.
Why does my business token get error 200 on a customer's WABA?+
Usually the customer did not share that WABA, or your app lacks Advanced Access for the permission. Check `granular_scopes[].target_ids` with debug_token, then the permission's access level in the App Dashboard.

Chapter 9 · What good teams do

Best practices for a business integration system user access token

  • Log the Embedded Signup session event (FINISH, CANCEL or ERROR) next to each exchange, so drop-offs are easy to diagnose.
  • Keep business tokens in a secrets store with per-tenant keys, and never write them to logs or tickets.
  • Alert on error 190 per customer: it usually means the customer removed your app, so offer a fresh signup link.
  • Delete a customer's token the day they offboard; it is the cleanest way to prove access has ended.

See InfiQ pricing

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms