Set up your API access
Everything here lives in one place: Settings → Console. You need a key to call the API at all, and a callback URL if you want to hear back about what you sent.
1. Create a test key
Under API keys, create a key and choose the test environment.
A test key takes the same code path as a live one but reaches nobody: no message leaves, nothing counts against your quota, and Verify returns the code in the response so your tests can read it. It needs no approved template, so you can build the whole integration before Meta approves anything.
Fill in:
| Field | What to put |
|---|---|
| Name | Where the key is used — CI, staging, a customer's name |
| Environment | test |
| Access | Only the scopes this key needs |
| Sender | The number this key sends from |
| Expires on | Optional. An end date, after which the key stops working |
The secret is shown once. Copy it now — it cannot be retrieved later. Lost it? Rotate the key, see Rotate a key safely.
2. Pick scopes
Tick only what the key needs. A service that sends login codes takes otp:send and nothing else,
so a leaked key cannot send marketing or create templates. A call outside a key's scopes fails with
insufficient_scope. The four scopes are listed on
API keys & environments.
The environment is fixed once the key exists — issue a new key to change it. The name, scopes and limits can all be edited later.
3. Set the key's limits
Three optional ceilings, all on the key: Rate limit (requests per minute), Messages per month, and Spend cap (what it may run up on your Meta bill). Leave one empty for no limit.
They sit inside your plan's allowance, not on top of it, and each returns its own error code when reached — see Per-key limits.
4. Set your callback URL
Do it now, in the Webhook endpoint panel on this same page. It is how you learn that a message was delivered, read or failed, and the only way to see a reply — no endpoint reads inbound messages. Nothing is queued while the endpoint is unset.
The three fields, and what arrives at the URL: Receive webhooks.
5. Create the live key
Same panel, live environment. Nothing in your code changes — swap the secret in your environment
and the same calls reach real people.
What changes is what WhatsApp enforces. Verify now needs your approved authentication template, the 24-hour window applies, and the code goes to the phone rather than coming back in the response. Test keys and the sandbox lists every difference.
Keep the test key
Keep one alive for CI and for reproducing bugs. It costs nothing and sends nothing.