Before you begin
Vacto uses Meta's official WhatsApp Business Platform Cloud API. It does not use WhatsApp Web, QR sessions, personal-account automation, browser bots, scraped endpoints, or unofficial libraries. Embedded Signup is future work; the current setup is a secure manual connection for a seller-owned business account.
Meta account, app, WABA, and phone
- 1
Create or select the correct Meta Business account.
Use the legal business that owns the sender and complete Meta's required business verification.
- 2
Create a Meta app and add the WhatsApp product.
Record the app, business ownership, and administrators; do not use a personal test app for production.
- 3
Connect or create the WhatsApp Business Account.
Keep the WABA owned by the seller's business.
- 4
Add and verify the business phone number.
Complete Meta's verification and display-name requirements.
- 5
Record the Phone Number ID and WhatsApp Business Account ID.
These numeric IDs are not the displayed telephone number.
- 6
Create the appropriate system-user access token.
Grant only the WhatsApp permissions required by the current Meta setup and establish a rotation/revocation process.
Webhook callback and verification
- 1
Generate a random webhook verification token.
Use at least 24 unpredictable characters and store the raw value only in the connection setup.
- 2
Set the callback URL.
Use https://vacto.shop/api/webhooks/whatsapp exactly for production.
- 3
Complete Meta's verification handshake.
Vacto compares a hash of the exact token and returns only the challenge.
- 4
Subscribe the WABA to the messages webhook field.
This field carries inbound messages plus sent, delivered, read, and failed status notifications under Meta's current Cloud API schema.
- 5
Save the verified Graph API version.
Enter the version currently supported by Meta. Vacto deliberately does not guess or silently advance it.
- 6
Run Health check.
The check uses the saved server-only token; no credential is returned.
Create and submit utility templates
- 1
Open the Templates tab.
Copy the stable English and Arabic names and exact numbered parameter layouts.
- 2
Create each template in WhatsApp Manager.
Choose the category required by Meta and preserve variable order, language, and quick-reply buttons.
- 3
Submit to Meta and wait.
Track Draft, Submitted, Approved, Rejected, Paused, Disabled, or Unknown; Vacto never assumes approval.
- 4
Record the approved state in Vacto.
Automation requiring a template remains blocked until approval state is synchronized or recorded through the controlled admin process.
Production-readiness checklist
- Connect and verify the seller-owned phone.
- Save Phone Number ID, WABA ID, explicit Graph version, system-user token, app secret, and verification token through the server-only form.
- Confirm signed sent/delivered/read/failed webhooks.
- Send one approved test template to an explicitly authorized number.
- Test Confirm order, Request cancellation, an unknown/free-text reply, and STOP.
- Confirm duplicate webhook delivery produces one transition.
- Enable one low-volume automation, observe it, then expand deliberately.