Exhibit A
Drag the clock: is this user token still alive?
Time since it opened
72 min
72 min in: window closed. Error 190, subcode 463: session has expired.
What is a user access token?
A user access token is a Graph API credential issued to a real Facebook user who has logged in and granted an app some permissions. You get one from Facebook Login (including Facebook Login for Business) or by clicking Generate Access Token in Graph API Explorer. Whatever it can do on WhatsApp comes from that person: their role in the business portfolio, the WhatsApp Business Accounts (WABAs) they can reach, and the permissions such as whatsapp_business_management they approved for the app.
User tokens are short-lived by default, usually about one to two hours. A server can exchange a short-lived token for a long-lived access token of about 60 days by calling /oauth/access_token with grant_type=fb_exchange_token and the app secret, but the result is still tied to the person. It is invalidated early if they log out, change their password, remove the app or lose access to the business, and every call then fails with error 190 (access token invalid), an OAuthException. Inspected with debug_token, it shows type: USER, an expires_at time and a separate data_access_expires_at, after which the person has to log in again.
That makes it the right tool for exploration and one-off admin work — trying a query in Graph API Explorer, inspecting a WABA's phone numbers, checking a new permission — and the wrong one for anything unattended. A system user access token is not tied to a person and can be set never to expire, so production senders, webhook-driven bots and template sync jobs should use it. Tech Providers onboarding customers through Embedded Signup exchange the returned code for a business integration token rather than holding anyone's personal user token.
Key takeaways
- A user access token is issued to one logged-in person, through Facebook Login or Graph API Explorer, and acts with that person's access.
- It is short-lived by default, about one to two hours, and can be exchanged on a server for a long-lived token of about 60 days.
- It dies early when the person logs out, changes their password, removes the app or loses access to the business portfolio.
- Expired or invalidated user tokens fail with error 190; subcode 463 means the session has expired.
- Use it for exploring and admin tasks; production WhatsApp sending belongs on a system user access token.
Why does a user access token matter?
Most "our WhatsApp integration stopped overnight" incidents start with a user access token. It worked in the demo because a developer had just logged in, then failed the next morning, or 60 days later, or in the week that developer left. Recognising a user token — by where it came from, its short lifetime and type: USER in the debugger — and replacing it before go-live prevents an outage and keeps production access from depending on one person's Facebook account.
How does a user access token work?
A person logs in
Through Facebook Login or Graph API Explorer, the user picks the app and approves the requested permissions. The token is issued for that user and that app.
It inherits the person's access
Calls succeed only on assets the user can reach in the business portfolio, and only within the scopes they granted.
It expires quickly
A short-lived token lasts about one to two hours. After that, calls return error 190 with
error_subcode463 (session has expired).It can be extended once
On a server, exchange it at
/oauth/access_tokenwithgrant_type=fb_exchange_tokenfor a long-lived token of about 60 days. It is still a user token.Life events end it early
Logging out, changing the password, removing the app or leaving the business invalidates the token at once, whatever its expiry says.
Replace it for production
Create a system user, assign it the app and WABA, and generate a system user access token for anything that runs without a person present.
A user access token in code
# Server-side only: this call needs the app secretcurl -G "https://graph.facebook.com/v26.0/oauth/access_token" \-d "grant_type=fb_exchange_token" \-d "client_id={APP_ID}" \-d "client_secret={APP_SECRET}" \-d "fb_exchange_token={SHORT_LIVED_USER_TOKEN}"# {"access_token":"EAAG...","token_type":"bearer","expires_in":5183944}
expires_in is in seconds: about 60 days. The result is still tied to the person who logged in.
Example: The demo that broke on Monday
A developer at a Jaipur jewellery brand builds a WhatsApp order-confirmation prototype over a weekend, pasting a token from Graph API Explorer into the config. It works through Saturday's demo. On Monday morning the first batch fails with error 190, subcode 463: the short-lived token had expired hours after it was issued. Rather than exchanging it for a 60-day token that would also die the next time she changes her password, the team creates a system user, assigns it the brand's WABA and app, and generates a non-expiring token with only whatsapp_business_messaging. The prototype becomes production without anyone's login in the loop.
Common mistakes with a user access token
Shipping a Graph API Explorer token
Explorer tokens are short-lived user tokens. Anything copied from it into deployed config fails within hours; generate a system user access token instead.
Treating 60 days as permanent
A long-lived user token still ends on logout, password change or app removal, and it expires anyway. Do not build unattended sending on it.
Exchanging tokens in the browser
The exchange needs your app secret. Run it on a server, never in client-side JavaScript or a mobile app where the secret can be extracted.
Retrying on error 190
An invalid token never recovers by itself. Detect code 190, alert someone, and pause the job until a valid token is in place.
User Access Token FAQs
How long does a Facebook user access token last?+
Can I send WhatsApp messages with a user access token?+
What does error 190 with subcode 463 mean?+
What is the difference between a user access token and a system user access token?+
Best practices for a user access token
- Check any token in the Access Token Debugger before deploying; a production token should not show type USER.
- Grant Explorer-generated tokens only the permissions the test needs.
- Keep user tokens out of logs and screenshots; they act with a real person's access.