Viber Business Account: Access & Permissions

The phrase “Viber Business Account” can mean a phone-based small business presence or the sender identity associated with Viber Business Messages. Viber also offers chatbots with a separate Chat API. These products answer different business needs and give access through different doors. A small shop can create a searchable account from its phone and answer customers in Viber. A bank sending transaction alerts to an existing customer database uses Business Messages through a messaging partner. A service that wants a bot conversation applies for a commercial chatbot. Viber’s small-business help, Business Messages page, and developer documentation describe these separate surfaces.

As of November 2026, the small business account starts in the Viber phone app at More > Create business account. Viber says it is available only in select countries, and each Viber-registered phone number can have one such account. The account can be created and edited only on the primary phone, though the owner can answer customers on linked desktop or tablet devices. Viber’s account-management guide gives the boundaries. This is not a shared team console with named marketing, analyst, and agent roles.

Business Messages is for scaled business communication, including promotional, transactional, and verification use cases and customer-initiated conversations. Viber’s Business Messages product page describes business-initiated and conversational messages. The developer guide says a business that wants API messaging by customer phone number applies through one of Viber’s official partners. A company buying that service needs to examine the partner’s user permissions and contract; Viber’s public bot-admin instructions do not define the partner platform’s seats.

Chatbots are a third route. Viber says bots have been creatable only on commercial terms since February 2024, either directly through Viber or through a verified official partner. A bot has an administrator after creation and an authentication token used for Chat API requests. This is distinct from the phone-based small business account. Viber’s bot documentation makes that distinction explicit.

Viber does not publish one cross-product hierarchy called Owner, Admin, Agent, and Analyst. Its public docs name a business owner for the small business account, an account administrator / admin for a bot, and a messaging partner for Business Messages. The table describes those documented positions, not fictional app-wide permissions. Partner platforms may provide additional seats, but their names and scope belong to that partner. Viber’s account help, Chat API, and partner directory are the current references.

For an eligible country, open Viber on the intended primary phone, tap More > Create business account, and follow the prompts. Viber may propose a business name, address, or category from public registries associated with the Viber-activated number; review those values before finishing. Viber’s setup article says a name can be up to 30 characters, and that the account needs accurate details, a logo, and a standard safety review before appearing in public search. Do not tell customers the page is searchable immediately after it is created.

To change details later, the owner uses the business icon or More > Business account settings on the phone. The same help article documents business hours, categories, catalog items, a website link, welcome messages, away messages, and business insights. Those are phone-side controls. The ability to reply from a linked desktop does not imply the desktop user can edit the business profile or transfer the account. A shop that gives an employee its linked desktop should treat that device as access to customer conversations, even though it is not a new owner role.

The owner cannot currently transfer a small business account to someone else, according to Viber’s ownership FAQ. This is the central offboarding fact for a founder who used a personal number. Viber says changing the registered phone number transfers both the personal and business account to the new number, but that is a number change, not an ownership transfer to a different person. If the original holder is leaving, plan a support and continuity path before losing the primary phone. Do not promise a role-invite button that Viber does not document.

The account is country-specific in discovery. Viber says a customer in another country will not see it in search results, although a business can share its business page by link or QR code. The owner can start a new conversation only with a person in the phone’s address book; other customers can start a chat themselves. Viber’s discovery guidance makes those limits important when a local business tries to use the account as a cross-border outreach tool.

If your requirement is to send account alerts, promotions, or verification messages to an existing customer database, ask about Viber Business Messages rather than the phone app’s small business account. Viber’s developer documentation explicitly directs API messaging based on phone numbers to Business Messages through an official partner. The partner directory can be filtered by product and destination country. A partner’s country coverage and Viber product support should be checked for the exact markets you serve.

The brand and partner should agree on the sender identity, approved use cases, consent records, access to the partner portal, message templates or campaign review where offered, and how to end the arrangement. Viber’s Business Messages page describes promotional, transactional, verification, and conversational formats; it does not publish a universal Viber seat-role matrix for every partner portal. Ask the partner to demonstrate adding a colleague, changing their permissions, disabling a former employee, and exporting an access record. Write those answers into the vendor handoff before live customer data is available.

Business-initiated delivery is not permission to message everyone in a CRM. Viber’s spam guidance says business messages are sent to people who agreed to receive them and identifies unconsented business messages as spam behavior. A brand importing a list should be able to show when those recipients agreed to Viber contact and what type of message they expected. If a recipient unsubscribes, stop that route; a partner’s delivery API does not override the recipient’s choice.

The Business Messages Partner Portal is another credential surface. Viber announced two-factor authentication for that portal in September 2026. That portal belongs to partner operations, while the phone PIN protects a small business Viber account and the bot token protects a chatbot. If an agency says “we enabled 2FA,” ask which of these logins it secured and which employee accounts still have access.

A Viber chatbot has an active Viber account as its administrator. The Chat API documentation says the bot creator becomes an admin and can find the app key under More > Settings > Bots > Edit Info > Your app key. The REST API guide says every request uses X-Viber-Auth-Token, and describes the token as a secret identifier that prevents unauthorized sends. A developer who sees that token can make authenticated requests even if they are not the person holding the phone.

The documentation also says chatbot tokens do not expire on their own. If a token is compromised, the developer FAQ directs the account to request a new one from Viber Support. That is the revocation path to plan for during vendor or employee offboarding; do not assume changing a phone PIN rotates the bot’s API token. Keep the app key in a restricted secret store, record which production service uses it, and replace it if a departing contractor could copy it.

An admin configures a webhook for the chatbot. Viber requires a valid HTTPS certificate, checks the endpoint for an HTTP 200 response, and allows one webhook per account. The REST API guide explains set_webhook and says sending an empty URL removes the webhook and disables the one-to-one conversation button. Removing a webhook can stop messages arriving at your backend, but it does not prove an exposed authentication token has been invalidated. Handle token replacement and webhook change as separate tasks.

Viber signs callbacks using an HMAC-SHA256 signature in X-Viber-Content-Signature, with the authentication token as the key, according to its developer security section. A webhook receiver should verify that signature before treating a callback as a real customer message. This is especially important when a chatbot’s webhook is public: an attacker could otherwise submit a forged “customer” event to the same URL. The customer’s subscription and opt-out state should also be handled from actual Viber events, not inferred from a copied contact list.

A small business account needs Viber’s standard safety review and a logo before it appears in public search. That is different from assuming every small account receives a universal verified tick. Viber’s small-business help also offers a separate connection to a verified Google Business Profile. If linked, Viber can display the profile’s rating and a Verified badge; Viber says disconnecting the Google profile removes those elements immediately. The badge in that flow is not proof of a chatbot token or a partner contract.

Viber’s customer-facing business guide says business accounts are marked with a business icon in the info screen. A customer may encounter a business in search, a business inbox, or an existing thread. A brand should use its exact approved name and logo so people can compare the sender with the business they intended to contact. Do not tell customers that a color alone proves every message is safe: Viber’s spam guide gives examples of suspicious links and impersonation.

For Business Messages, Viber’s product page describes official business presence and account verification. Ask the partner to show the exact sender profile and review state for each market before a campaign. A partner demo using a different brand or destination is not evidence that your own sender has been approved. The phone-based account’s search review, the chatbot’s commercial approval, and a Business Messages sender are separate checkpoints.

On the primary phone, turn on Viber’s 2-step verification at More > Settings > Privacy > 2-step verification and keep the recovery email current. Viber says the PIN is requested for a new phone and sensitive account changes; losing both the PIN and recovery email can lock the owner out. Viber’s 2-step verification guide gives the exact menu and recovery behavior. A business owner should choose an email the company can still access after a staff change.

Review linked desktops and tablets, especially devices used by former employees. Viber documents remote desktop removal from the phone at More > Settings > Account > Desktop and tablets, then choose the device and Deactivate. Viber’s deactivation guide says desktop deactivation logs out that device and removes its local data. This is more direct than simply taking back a laptop while the Viber session remains signed in.

For Business Messages, request the partner’s active-user list, role definitions, credential inventory, campaign history, and revocation procedure. Confirm the 2FA state of its Partner Portal. For chatbots, review each admin and every place the app key is stored, ask Viber Support for a new token if exposed, and validate the webhook signature check. A complete offboarding record should say which phone, partner portal user, bot admin, secret-store permission, and webhook deployment were changed. Removing one of them leaves the others in place.

Viber’s small business account offers Business insights such as reach, subscribers, chats, and average reply time over the previous 30 calendar days. Those are performance measures, not a published employee access log. A partner may have its own audit trail; ask for it explicitly. If no per-person trail exists, reduce shared credentials and keep a separate change record. For a bot, log only safe metadata such as delivery result and request ID in your own service; never put the app key or full customer message into an operational log.

Mistake: planning a team handoff around a phone-based “admin invite.” Viber says small-business ownership cannot currently be transferred. A founder using their personal number should resolve the continuity question before asking an agency to operate the account. Viber’s ownership answer is explicit.

Mistake: buying Business Messages when the need is a local storefront chat. A cafe that wants customers to find it and ask opening hours may only need the small business account where available. A bank sending one-time passwords needs the partner-operated service. Viber’s business product page and small-business help show these different jobs.

Mistake: assuming the same search reach across borders. Viber says small business accounts are country-specific in public search, and creation itself is limited to select countries. A shop near a border may need to share its direct link with customers across the border instead of relying on search discovery. Viber’s country guidance supports that distinction.

Mistake: calling every business icon a verified badge. Search review, a business icon, a Google-profile-linked Verified badge, and an enterprise sender’s approval are separate facts. Inspect the actual profile and the relevant review path before making a claim to customers. Viber’s account guide explains the Google-profile badge.

Mistake: removing a webhook and declaring the bot key safe. The webhook governs inbound delivery, while the token authorizes API requests. A former developer with a copied token may still have sending capability. Viber’s REST API describes both controls; request a replacement token through Viber when needed.

Mistake: treating a customer list as consent. A retailer may have phone numbers from receipts but no agreement to send Viber promotions. Viber’s spam help identifies messages without consent as spam behavior. Check the permission record with the partner before importing recipients.