developers.facebook.com is the technical side of the same integration Business Settings manages the business side of — App ID, App Secret, webhook config, and the two very different kinds of access token.
4 min read
If Business Settings (previous lesson) is "who owns this and what's allowed," developers.facebook.com — "Meta for Developers" — is "the actual code-facing credentials and configuration": App ID, App Secret, access tokens, webhook URLs, API version.
developers.facebook.com/apps lists every App a Business Portfolio has created. This is a genuinely overloaded word worth pinning down immediately:
A Meta "App" is not the product being built. It's a registration/credential container Meta requires for any integration with its Graph API — WhatsApp Cloud API included. Whatever name is chosen for the App during setup isn't a customer-facing product name; it's the Meta-side technical registration that a backend authenticates through. A Business Portfolio can own multiple Apps; a single App can, in principle, serve multiple products at once.
Clicking into an App opens its own dashboard, roughly:
messages, message_template_status_update, etc.) — directly relevant to receiving inbound messages, covered in a later lesson.Two different kinds:
Temporary token - generated right on the WhatsApp product's "API Setup"
page. 24-hour expiry. Tied to whoever's logged in
when it's generated. Fine for an initial test send,
useless for production.
Permanent token - generated via a System User in Business Settings
(not from the App dashboard directly) — pick which
assets (this App, this WABA) the System User has
permission to act on, then generate a token scoped
to those permissions. Typically requires
second-admin approval. This is the credential that
belongs in a real deployment's environment
variables.
The temporary token is a genuine trap for a first-time integrator — it works perfectly during testing, then mysteriously stops working a day later in what looks like a production incident but is actually just expiry. Production code should always run on a System User's permanent token.
developers.facebook.com/tools/explorer — a browser-based tool for manually firing API calls against a token, useful for debugging ("does this token actually have permission to send from this phone number?") without writing any code. Faster than a round-trip through an application's own logs for a one-off check.
Check your understanding
A quick comprehension check — not tracked, not graded, just for you.
1. A teammate asks "is the App we created our actual product?" What's the accurate answer?
2. An integration sent messages fine during a week of testing, then every send started failing exactly 24 hours after the demo. What's the most likely cause?
3. A developer has "Developer" App Role on the Meta App but can't see the WABA's billing settings. Why?
4. Where would a developer configure which webhook fields (e.g. `messages`, `message_template_status_update`) an App subscribes to?
WhatsApp & Meta Platform Integrations