WhatsApp Business Account Roles and Permissions

The WhatsApp Business app is a mobile app with a business profile, labels, quick replies, greeting messages, and an inbox. The WhatsApp Business Platform is an API that connects to software and agents. A founder can start with the app and later add Platform capabilities, but an API token is not the same thing as a linked phone. WhatsApp’s product comparison explains the product split, and its Platform FAQ says a business can integrate directly or use an approved partner.

For a shop with three people answering one number, the app may be enough. The primary phone registers the number and links other devices; team members see the same customer chats. For a support operation that needs automation, webhooks, or many agents, the Platform is the relevant control plane. The Platform itself is an API, so the agent desk may be a provider’s software or software the business builds. Ask which system stores chat history and who can remove a user from it. WhatsApp says the Platform is not an app and describes its direct and partner integration paths.

Meta’s public material has changed in 2026, so the labels in an older setup guide may not match a new account. A June 2026 Meta explanation introduces a WhatsApp Account (WAAC) for phone numbers and a Messaging Account (PMA) for templates and billing, evolving the older WhatsApp Business Account (WABA) model. Meta says this permits one number to work with multiple partners while separating billing. Keep the IDs shown in your own Meta Business Suite and onboarding flow rather than assuming every partner screenshot still displays one WABA. Meta’s account-model update is the current reference.

The app, the primary phone, and a linked device form one access surface. The Meta business portfolio, its WhatsApp asset, and a system user form another. Meta’s public API collection shows a business portfolio ID, owned WABAs, a WhatsApp phone number ID, and tokens as separate values. A teammate who knows one ID cannot call the API without a valid token and permission; a person with a linked device may answer chats without possessing any API credential. Meta’s Cloud API collection lays out those identifiers.

The table includes holders and API tasks named in the public WhatsApp material. The app’s linked devices are sessions, not a native hierarchy of “owner,” “agent,” and “viewer” roles. Meta Verified can add agent chat assignments in the app, but do not assume a subscription gives the same asset permissions as Meta Business Suite. On the API side, check both the person’s portfolio access in Business Suite and the WABA or newer account asset assigned to the integration. For the specific task of reserving a WhatsApp username, WhatsApp Help names full control of the Page or account, or basic partial access with the manage_phone permission. That narrow example is a reason to inspect the actual task grant rather than assuming all partial access has the same power. WhatsApp’s app features and Meta’s Embedded Signup examples show these distinct layers.

On the primary phone, open Linked devices and choose Link a device. Open WhatsApp Business on the computer, tablet, or companion phone and scan its QR code with the primary phone. The employee then has a session tied to the same number. WhatsApp’s help guide says the app supports four linked devices at once on its standard path and that the primary phone must be used periodically to keep them connected. The official linked-device guide gives the Android and iPhone menu paths.

Do not treat the device label as an identity system. If two staff members share one browser profile, removing a named employee from a spreadsheet will not end that browser’s WhatsApp session. Give each employee a separate device or profile, name the device in the access register, and check who can sign in to it. For offboarding, return to Linked devices on the primary phone, select the departing employee’s session, and log it out. WhatsApp recommends reviewing linked devices and removing unrecognized sessions; its help page also describes automatic disconnection after inactivity. WhatsApp’s device review instructions cover that check.

Meta Verified is a different app feature. WhatsApp says eligible subscribers can link up to ten devices and agents and assign customer chats; Meta One is being introduced as an optional native subscription, while existing Meta Verified users are being migrated in stages. Check the plan shown in the app rather than promising ten seats to every business number. The Business app features page states the ten-device benefit, and Meta One’s FAQ says it does not change the Platform API. If the subscription ends, check the live linked-device list again rather than assuming every old session still has the same access.

For the Platform, start in Meta Business Suite with the business portfolio that owns the relevant WhatsApp asset. Record the portfolio ID, the WhatsApp asset ID, and the phone number ID. Meta’s public API collection says the portfolio ID appears as business_id in the Business Suite URL; its owned-WABA query can return the WABA and number IDs. This inventory prevents a common mistake: removing a developer from one portfolio while the production number is registered under another. Meta’s Cloud API setup reference documents the lookup sequence.

A human’s Business Suite invitation and an API system user are different grants. Give a person access to the specific WhatsApp asset they need in portfolio settings, then check whether an integration requires a system user assigned to that asset. Meta’s Embedded Signup material uses the assigned_users endpoint to inspect and assign system users to WABAs and names the API tasks MANAGE and DEVELOP. The same material tells partners to subscribe an app to a WABA for webhooks. Meta’s Embedded Signup reference describes those steps.

When the person leaves, remove their Business Suite access to the portfolio and WhatsApp asset. Then check any system user and token created for their integration, any subscribed app, the provider’s own agent desk, and its webhooks. Removing a human login does not automatically revoke a long-lived system-user token that a server still uses. Conversely, deleting a system user can interrupt production messaging, so identify its owner and consumers first. If an agency operates the channel, ask it to show the asset and system-user grants in your portfolio and its own user list before signing off. The Meta Cloud API collection distinguishes user tokens from system-user tokens.

Meta’s Cloud API uses whatsapp_business_messaging to send messages and whatsapp_business_management to manage WhatsApp assets. Some portfolio-level queries also require business_management; Meta says most developers do not need that extra permission. The app dashboard can issue a short-lived user token for testing, while a system-user token may be configured for up to 60 days or permanently. “Permanent” is an expiry choice, not a reason to leave a credential in source code or a contractor’s laptop. Meta’s official Cloud API collection lists the permissions and token types.

A token holder with messaging permission can call the messages endpoint for a registered number it can access. It may send text, media, and templates, and receive status through webhooks. The third-party app or provider can also keep a copy of conversations inside its own system. When a provider is removed, revoke its app and system-user grants in Meta and separately delete or disable its users in the provider’s desk. A token rotation alone does not remove a provider’s stored data or end a separate subscription. Meta’s messages endpoint description documents the send surface.

Phone-number ownership is an operational prerequisite. Meta’s registration flow says the business must prove control of the number through SMS or voice verification and set two-step verification when registering it for Cloud API. A provider that receives the OTP during onboarding should not become the only party that can receive future codes or manage the PIN. Keep the number contract, recovery route, Meta portfolio, and two-step PIN custodian under business control. Meta’s registration reference explains the number and PIN checks.

Direct integration and partner integration are both official paths. A partner may handle technical setup through Embedded Signup, while a direct integration uses the business’s own number and developer resources. The choice changes who operates the software, but it does not remove the need for the business to know which portfolio owns the asset. Meta’s 2026 WAAC/PMA explanation is a reason to ask a provider for the current phone-number and messaging-account IDs, not an excuse to rely on an old WABA screenshot. WhatsApp’s setup options and Meta’s account-model update describe the current options.

The WhatsApp Business app’s Meta Verified badge tells customers Meta has authenticated the business in that subscription program; it is not proof that a contractor has the right portfolio permission. Meta One is a newer app subscription and Meta says existing Meta Verified users are not all moved at once. When budgeting for extra linked devices or chat assignment, inspect the plan on the actual number and region. Meta Verified’s business page describes the badge and multi-agent benefit, while Meta One’s page distinguishes the native subscription from the Platform.

On the Platform, the display name, phone registration, business verification, and messaging eligibility are separate checks. Do not tell a team that a checkmark or legal-entity review has raised a particular send limit unless the current WhatsApp Manager view shows it. Limits and account architecture can change, so check the actual number status, display name, quality information, and country settings in WhatsApp Manager before launch. Meta’s official developer hub is the route to current configuration guidance.

The app and Platform can now be used together on some setups: WhatsApp’s own inbox guide says a business can connect the Business app to the Platform on the same number while keeping the app and chat history. That is a product path to check for your account, not a blanket promise that every existing provider configuration supports the same workflow. Confirm with the onboarding flow and a small pilot before migrating an active sales number. WhatsApp’s inbox guide describes the coexistence path. For a product choice before assigning staff, use WhatsApp Business vs Business API for CRM.

For an app-only team, inspect the primary phone, Linked devices, any Meta Verified agent assignment, and any Meta Business Suite inbox access. Log out the departing employee’s session and reassign their chats. Then send a test customer message and confirm an authorized teammate receives it. If the employee also had the SIM, move number control before their departure; a linked browser cannot register a replacement primary phone. WhatsApp’s device guide makes the primary-phone dependency explicit.

For a Platform team, inventory portfolio members, WhatsApp assets, system users, tokens, subscribed apps, webhooks, and provider seats. Remove the human and provider seats first, identify which server uses each token, then revoke or replace the appropriate token and confirm message delivery. Test an inbound customer message, an authorized reply, a template send if used, and a webhook event. Save the test result with the date. A stale token that still sends is a security problem; a revoked token that was still production-critical is an outage. Meta’s Cloud API overview shows the token and webhook model.

Use a short access record for each number: number owner, primary phone custodian, portfolio ID, WhatsApp asset ID, integration app, system-user ID, token custodian, provider, and next review date. Do not paste the token into that record. A support lead can check who is allowed to answer; a developer can check which credential sends; an owner can see whether a former agency still has a path into the number. That makes the next departure a planned change rather than a search through old setup emails.

Calling linked devices staff roles. Four browsers connected to one app number do not give four independent permission profiles. If a contractor’s browser remains linked after their contract ends, they can still see the shared inbox. Log out that session from the primary phone and inspect the device list again. WhatsApp’s linked-device guide describes removal.

Assuming a verified badge grants API access. A badge helps customers recognize a business; the API still requires a token, asset assignment, and permissions. A sales rep with an app badge cannot automatically call Cloud API. The Meta Verified page describes the badge, and the Cloud API reference describes API authorization.

Letting an agency receive the only number OTP. If the agency controls the SIM or voice line, a later provider switch can stall even if your portfolio members are correct. Registration requires proof of phone-number control. Keep that verification route under a named business owner. Meta’s registration reference sets out the requirement.

Treating a permanent token as a permanent employee. A system-user token can outlive the developer who created it. When a developer leaves, find the integration that uses the token and replace or revoke it in a controlled change. Do not disable the sole production sender before identifying its replacement. Meta’s token guidance explains the longer expiry option.

Using old WABA diagrams as the whole account map. Meta’s 2026 WAAC/PMA model separates a number from templates and billing for new account architecture. Ask the provider for the current IDs and the asset that owns the number. A billing account and a phone number are related but are not interchangeable. Meta’s account-model explanation is the starting point.