How to Set Up the WhatsApp Business API: Step-by-Step

The WhatsApp Business API — officially the WhatsApp Business Platform — is the infrastructure that lets software send and receive WhatsApp messages programmatically: many agents on one number, automated flows, templated broadcasts to thousands of opted-in contacts, and bots that answer in milliseconds. It is not the green WhatsApp Business app you install on a phone. The Platform has no standalone app and no on-device UI; you reach it through a Business Solution Provider's software or through your own integration against Meta's hosted Cloud API.

That distinction matters because almost every failed setup we see comes from treating the API like the app. This guide walks an engineering-aware first-timer from an empty Business Manager to a verified, message-ready number, explains the two real connection routes and their cost structure, and flags the gotchas that quietly throttle or block numbers after go-live.

How we approached this guide

We wrote this against Meta's current public developer documentation, the embedded-signup flow that every major BSP now ships, and the pricing model that took effect in mid-2025 (per-message, replacing the older per-conversation model). Where exact figures move by country and category, we give ranges and direction rather than precise cents — Meta revises rate cards regularly and they differ across markets, so any single number printed here would be stale within a quarter. Verify live rates in the Meta WhatsApp pricing docs before you forecast spend.

Before you start: the pre-flight checklist

Line these up first or you will stall halfway through the wizard:

• A Facebook (Meta) Business Manager account that legally represents your business, created at business.facebook.com.
• A phone number you control that is not currently active on the WhatsApp consumer app or the WhatsApp Business app. This is the single biggest blocker — see Step 4.
• The ability to receive an SMS or voice call on that number for the one-time verification PIN. A landline works if it can take a voice call.
• Your legal business details — registered name, address, and ideally a live website and a business-domain email — for Business Verification.
• A decision on your connection route: a BSP's embedded signup, or Meta's Cloud API directly. The next section is the most consequential choice you will make.

Step 1: Set up Facebook Business Manager

Create a Business Manager account and enter your real legal business name, business email, and website. This entity becomes the legal owner of the WhatsApp Business Account, the phone number, the templates, and the quality rating that follow. Meta cross-checks these details during verification, so sloppy or placeholder data here resurfaces as a rejection later. Add yourself with a full admin role and confirm two-factor authentication is on — Meta blocks several Platform actions for accounts without 2FA.

Step 2: Choose your route — BSP vs Cloud API

There are two practical architectures. The decision drives your cost, your time-to-live, and how much engineering you own.

Route A — Through a BSP (embedded signup)

A Business Solution Provider runs Meta's embedded signup wizard inside its own software. In a single OAuth-style flow it provisions your WhatsApp Business Account (WABA), attaches your number, and hands you an inbox, automation builder, broadcast tooling, and analytics without you touching a webhook. This is how most businesses go live, and it is the only sane route if you are not shipping your own integration. Providers like WATI, Respond.io, and Gallabox sit in this layer; our WATI review and Respond.io review break down what each adds on top of raw Meta access.

Route B — Direct on Meta's Cloud API

Meta hosts the Cloud API for free (you still pay messaging fees) and you build the integration yourself in the Meta developer portal: register a Meta app, wire the webhooks, manage access tokens, and call the Graph API endpoints to send messages and templates. This suits engineering teams that want full control, no per-seat middleware fee, and the ability to embed messaging natively in their own product. The trade-off is that you own token rotation, webhook reliability, retry logic, media handling, and the inbox UI — none of which a BSP makes you think about. If you are weighing the direct route specifically to escape Twilio's markup, the Twilio WhatsApp alternatives comparison is the right next read.

The on-premise client (the old self-hosted Docker option) is deprecated and being sunset; do not start a new project on it.

The trade-off at a glance

Step 3: Create the WhatsApp Business Account (WABA)

Inside Meta's setup (or the BSP's embedded signup), create a WhatsApp Business Account and bind it to your Business Manager. The WABA is the container that holds your phone numbers, your message templates, and your quality rating. The hierarchy is worth internalising: one Business Manager can own multiple WABAs, and one WABA can hold multiple phone numbers. Agencies managing many clients lean on this nesting heavily — the white-label WhatsApp tools for agencies guide covers how that multi-tenant structure plays out in practice.

Step 4: Add and verify your phone number

Add the number you prepared. Two things determine success:

1. The number must be free of any existing WhatsApp account. If it currently runs on the consumer or Business app, delete that account inside the app first (back up chats — they will not migrate to the API), then wait for full deregistration before you attempt registration. Trying to register a number that is still active is, by a wide margin, the number-one cause of setup failure.
2. Verify it with the one-time PIN Meta sends by SMS or voice. Once verified, the number becomes an API number and can no longer be used in the regular WhatsApp app — the move is effectively one-way.

A clean, dedicated number you do not also use for personal chat is the right default.

Step 5: Complete Business Verification

Meta requires Business Verification to unlock higher messaging limits and full functionality. In Business Manager's Security Center, submit documents proving your legal name and address — business registration, a utility bill, or similar. This step is asynchronous and ranges from minutes to several business days depending on the queue and how clean your documents are. You can usually start testing in a sandboxed, capped state before it clears, but you stay throttled until approval lands. Get this moving early; it is the most common scheduling surprise.

Step 6: Set and approve your display name

Your display name is what recipients see in their chat list. It must comply with Meta's display-name policy: it should map to your real, verified business, and generic, misleading, or trademark-infringing names get rejected. Submit it for review. A rejected display name is a frequent and frustrating snag — keep it tied tightly to your verified business entity. If you also want the verified business badge, the WhatsApp green tick verification guide explains how that separate review works and why most accounts do not get it on the first try.

Step 7: Create your first message templates

Outside the 24-hour customer-service window, you can only initiate conversations with pre-approved templates. Create at least one — an order confirmation, an appointment reminder, a welcome message — pick its category, add variables, and submit for Meta's review. Categories matter because they drive both approval scrutiny and cost:

• Utility — transactional, tied to an existing order or account action.
• Authentication — one-time passcodes and login codes.
• Marketing — promotions, announcements, re-engagement; the most expensive and most scrutinised.

Approval typically takes minutes to a day. Keep templates genuinely useful and non-spammy: low-quality marketing templates both get rejected more often and drag down the number's quality rating once live. For the broadcast side of this, the WhatsApp broadcast software roundup covers tooling that manages template libraries and opt-in lists at scale.

Step 8: Understand the rules before you send

Four concepts govern everything from here, and getting them wrong is what turns a healthy number into a throttled one.

The 24-hour service window

When a user messages you first, a 24-hour customer service window opens during which you can reply with free-form (non-template) messages. After it closes, you must use an approved template to re-open contact. Service-window replies are free under the current model — a meaningful change from the older per-conversation billing.

Per-message pricing

Since mid-2025 Meta bills per template message delivered, by category and destination country, rather than per 24-hour conversation. Authentication and utility messages are cheaper; marketing is the premium tier; user-initiated service messages within the window are free. These Meta fees are entirely separate from any BSP subscription — a point teams routinely miss when budgeting. The chart below shows the relative cost ordering, not absolute prices.

Quality rating and messaging tiers

Each number carries a quality rating (green / yellow / red) derived from how recipients react — reads, replies, blocks, and reports. Numbers start in a low messaging tier (a capped number of business-initiated conversations per day) and earn promotion to higher tiers by sending well-received messages at volume. Spam, cold sends, and high block rates push you to red and throttle you hard. Treat the rating as a production SLI you monitor.

Opt-in is non-negotiable

You may only message people who have opted in through a channel you can evidence. This is both policy and the practical lever that keeps your quality rating healthy.

Step 9: Connect, test, and go live

Wire the number into your software — the BSP inbox and automation builder, or your own app via Cloud API webhooks. Then run the round-trip before you announce anything:

• Send a free-form reply to your own phone inside an open session window.
• Send an approved template outside the window and confirm delivery.
• Confirm inbound messages reach your webhook or inbox and trigger your automation.
• Check delivery and read receipts flow back as status callbacks.

Only once that full loop is green are you actually live. If a bot is part of the plan, validate it here too — the no-code WhatsApp chatbot builders guide covers how the automation layer typically attaches to a freshly provisioned number.

A quick build-vs-buy gut check

The architecture choice from Step 2 has a cost shape worth visualising. Direct Cloud API has near-zero marginal software cost but a real upfront engineering investment; a BSP inverts that — trivial to start, with a recurring markup that compounds with volume.

Common setup mistakes to avoid

• Trying to register a number still active in a WhatsApp app — deregister and wait first.
• Using a number that cannot receive an SMS or voice verification code.
• Skipping or delaying Business Verification, then wondering why the daily cap is tiny.
• A display name that does not match the verified business entity.
• Submitting spammy marketing templates that get rejected or quietly erode quality rating.
• Assuming Meta's per-message fees are bundled into the BSP subscription — they are billed separately.
• Cold-blasting a purchased list on day one and watching the number drop to red.

After you're live

Start small and grow volume gradually so Meta promotes your messaging tier on evidence of healthy engagement. Build a tight library of approved templates for your routine outbound messages, respect the 24-hour window, and message only opted-in contacts. Watch the quality rating like any other production signal, and keep marketing-category sends genuinely wanted. If conversation costs become a line item that matters, the reduce WhatsApp conversation costs guide breaks down where the spend actually goes and how to trim it without throttling growth.

Get these fundamentals right and the WhatsApp Business Platform becomes a reliable, scalable channel — rather than a number that quietly gets capped, flagged, or blocked.