WhatsApp Embedded Signup: Connect to the API in Minutes

WhatsApp Embedded Signup is Meta's own window that opens inside a partner's website to connect your number to the official API. In it you log in with the account that manages the business, choose the business portfolio, the WhatsApp Business account, and the number, and authorize the partner to operate that number. At the end, Meta hands the partner only the identifiers and an authorization code; your password never goes through the partner. The whole process takes minutes, and does not require creating an app in Meta for Developers or reading documentation.

This article explains what happens on each screen, who is on the other side of the window, what is left to do after connecting, and the errors that actually happen along the way.

What is Embedded Signup, in a short answer

Before Embedded Signup, using the official WhatsApp API required creating a developer app at Meta, requesting permissions, going through review, and configuring everything by hand. It was a programmer's job, and most companies hired an intermediary to do it.

Embedded Signup flips that. The partner, who already has an app approved by Meta, embeds a button on its site that opens a Meta window. The window is hosted by Meta, runs on Meta's domain, and Meta is the one that authenticates you. The partner only receives the result: the number is now linked to its app, and it can send and receive messages on your behalf.

According to Meta's documentation, the flow creates or associates three things: the business portfolio, the WhatsApp Business Account (WABA), and the number. That is why it works both for those who already have everything registered and for those starting from scratch at Meta.

Note: Embedded Signup is the technical name. Some providers call it "embedded signup" in plain terms or just "connect through Meta." It is the same window.

What happens in Meta's window, step by step

The window has few screens, and it is worth knowing what each one asks for so you do not get stuck midway.

Business portfolio, WhatsApp Business account, and number

1. Meta login. You log in with the personal Facebook account that manages the business. If the company does not yet have a business portfolio, the window offers to create one on the spot.
2. Business portfolio. This is the entity that represents the company at Meta, the same one as Business Manager. The number and the WhatsApp Business account will belong to it, not to the partner.
3. WhatsApp Business account. You choose an existing one or create a new one. It groups the numbers, the templates, and the payment method.
4. Number. Here the two paths split: a number that is already in the WhatsApp Business app on the phone, or a new number that will live only on the API. The next section details the difference.
5. Confirmation. On the already-in-the-app path, the phone asks for confirmation and asks whether you want to share history and contacts with the partner. On the new-number path, Meta sends a verification code by SMS or call.

When you finish, the window closes and the partner's site receives the result. On the partner's side, a few more calls to Meta are still needed: exchange the authorization code for a token, check the number's state, and subscribe to events. All of that happens in the following seconds, without your involvement.

What Meta returns to the partner and what it doesn't see

What leaves the window for the partner is small and well defined: the WhatsApp Business account identifier, the number identifier, and a single-use authorization code, exchangeable for an access token. The completion event has this shape:

{
  "type": "WA_EMBEDDED_SIGNUP",
  "event": "FINISH",
  "data": {
    "phone_number_id": "123456789012345",
    "waba_id": "987654321098765"
  }
}

What the partner does not receive: your Facebook password, access to your personal account, the portfolio's other assets (pages, ad accounts, other numbers). The token it obtains is valid only for what the window authorized, and you can revoke it in Business Manager at any time, under Settings, Partners.

For this window to even open, the partner's app must have passed Meta's App Review with advanced access to two permissions, whatsapp_business_management and whatsapp_business_messaging. A partner without that approval cannot connect any customer through Embedded Signup, which is already a first filter for seriousness.

Two paths: a number already in the app or a new number

The choice of number decides what happens next. The table summarizes what changes, and the article on WhatsApp Business coexistence with the API goes deeper into the first path.

The registration detail is what makes the two paths incompatible with each other. A new number needs to be registered with an API call, and without it no send works. A number in coexistence is already registered, through the phone app, and repeating the registration logs the app out, irreversibly on that side. A partner that treats both paths the same way knocks out the WhatsApp on the phone of whoever chose coexistence.

In practice, the partner tells Meta which path it wants before opening the window, and Meta itself filters the numbers that show up to choose from. If you asked for a new number and picked one that is actually in the app, a careful partner corrects the mode to coexistence and carries on, because that is safe. The opposite, registering on its own a number that Meta says is not in the app, must never happen automatically.

Who is on the other side: Tech Provider vs. Solution Partner

The partner that opens the window is always a company registered at Meta as a solutions provider. Meta recognizes two kinds, and the difference changes what you pay and to whom.

According to Meta's page on providers, the Solution Partner is a Meta Business Partner that offers the full service: messaging, integration, support, and billing. It is the only type that can extend a credit line and charge the customer for API usage. The Tech Provider offers the software, and only that. Meta charges the customer directly for the messages, and the Tech Provider charges only for its own product.

What is often called a BSP, short for Business Solution Provider, is the old name for the Solution Partner. It is not a synonym for Tech Provider, although both open the same window.

Why with a Tech Provider you pay Meta directly

The practical consequence is the one that matters most to anyone choosing. With a Tech Provider, the per-message cost is Meta's table price, without an intermediary, and it shows up on the invoice of your own Business Manager. The provider has no way to add a margin on messages, because the money does not pass through it. What it charges is the software, usually per number or per subscription.

With a Solution Partner, Meta's invoice comes bundled into the partner's invoice, which can offer credit, payment in reais (R$, the Brazilian currency), and terms of its own. For large operations that can be an advantage; for most companies, it is one more layer between you and the published price. The article on how much the WhatsApp Business API costs separates what is Meta's from what is the provider's.

Frame Conexa is a Tech Provider verified by Meta, with App Review approved in August 2026. That is what allows the dashboard to open Embedded Signup and connect customers' numbers.

How to tell whether the partner is verified

There is no visible badge in the window, but there are three signs that cannot be faked.

The first is the window itself: it belongs to Meta, on Meta's domain, and shows the name of the app and the company asking for authorization. If the "provider" asks for your Facebook password in a form on its own site, or asks you to scan a QR code as in WhatsApp Web, that is not Embedded Signup. It is something else, and the article on official vs. unofficial API explains the risk.

The second is Business Manager. After connecting, the partner appears under Settings, Partners, with the assets it has access to. If it is not there, it is not operating through the official API.

The third is the customer cap. Meta limits how many customers an app can connect: 10 per 7-day window for an unverified app, and 200 for one that completed business verification, App Review, and access verification. A partner connecting dozens of customers per week can only do so because it went through all three.

After connecting: payment at Meta and business verification

Connecting the number does not finish the job. Two steps stay on your side, and the partner cannot do them for you.

Register payment at Meta. Since the Tech Provider does not extend credit, Meta requires the account owner to register a payment method in their own Business Manager. Until that happens, the WhatsApp Business account stays blocked from sending outside the customer service window: no Meta-approved message goes out, no bulk send happens. Replying to people who wrote in the last 24 hours keeps working, which is deceiving: support looks healthy and the campaign does not go out. The path is Business Manager, Settings, Payments, inside your portfolio, and the API payment method guide shows each step.

It is worth knowing that Meta's billing changes on 10/01/2026: service messages, which are free-form replies inside the 24-hour window, and utility templates sent inside that window start being charged per message. Until then, those messages are free. Check the table Meta published in September 2026 and confirm the official rate card before doing the math.

Verify the business. Verifying the portfolio in Business Manager, with the company's documents, is what takes the number out of the first capacity tier. Without it, the account starts with a limit of 250 unique recipients per 24 hours outside the customer service window, and growth depends on the volume and quality of sends. The article on WhatsApp Business API messaging limits explains the tiers and the automatic scaling.

Important: both limits are Meta's, not the provider's. The block for missing payment and the capacity cap show up in any partner's dashboard, because they come from the WhatsApp Business account, which is yours.

Real Embedded Signup errors and how to fix them

The flow almost always ends well. When it doesn't, the error is usually one of these three, and all were measured in real connections.

2388002: partner already assigned to the account

It appears on the screen where you enter the number, on the coexistence path, with the message "Failed to check phone number eligibility." Nothing reaches the partner, because the authorization dies before being issued. From the outside, it looks like the person closed the window.

The cause measured in production, in August 2026, was an already-assigned partner: an earlier attempt of the same flow had left the partner with access to that number's WhatsApp Business account. With the partner there, the eligibility check fails on every following attempt.

The fix is in the number owner's Business Manager: Settings, Partners, the partner in question, the WhatsApp account, Manage, Remove access. When you redo the flow, eligibility passes and Embedded Signup itself reassigns the partner. Do not remove the number from the account or delete the WhatsApp Business account to "start from scratch": eligibility for coexistence depends on the number's history in the app, and restarting that link resets the clock.

Authorization completed, but nothing happened: the 15-minute window

The Meta SDK that opens the window has a 15-minute limit, counted from page load, not from the click. If the person takes longer than that inside the window, confirming on the phone, reading screens, waiting for the SMS, the authorization completes on Meta's side, but the partner's site has already given up waiting. Result: the window closes looking like a success and nothing happens.

We measured this in September 2026, with a customer who lost two authorizations in a row for this reason before connecting on the third. The lesson is simple: open the window with the phone in hand, the WhatsApp Business app updated and open, and proceed without pauses. If it went past 15 minutes, reload the page and redo it. Nothing was broken at Meta; the earlier authorization just was not received.

It is also why a careful partner records every drop in the funnel, with the reason. Without that, "Meta refused," "the person gave up," and "the time ran out" become the same thing in support.

Pop-up blocking and the browser

Meta's window is a pop-up. Browsers block pop-ups that do not originate from a direct click, and some block all of them by default. In Safari in particular, any delay between the click and the opening makes the window detach from the site, and the authorization completes at Meta without the site finding out. A well-implemented partner opens the window on the very first instruction of the click, and preloads what it needs before enabling the button.

On your side: allow pop-ups for the partner's site, use Chrome, Edge, or Firefox if Safari is giving trouble, and avoid opening the flow inside another app's built-in browser, such as Instagram's or WhatsApp's, which does not open pop-ups reliably.

How it works in Frame Conexa: dashboard, shareable link, or SDK

In Frame Conexa, Embedded Signup appears in three places, for three different situations.

In the dashboard. This is the path for someone with the phone in hand and the account in the dashboard. The Connect WhatsApp button opens a guided five-step flow, chooses the mode before opening Meta's window, checks the number's state after authorization and, in the case of coexistence, tracks the history import. Any drop in the funnel, including 2388002 and the 15-minute limit, is recorded with the reason.

By shareable link. The person who buys is not always the person who has the WhatsApp. An agency, a consultant, or software serving several customers generates a connection link in the dashboard and sends it to the end customer. They open the link, without logging in, and do only the authorization at Meta. The number is created in the account of whoever generated the link and uses its slot. The link is single-use and is only consumed on success, so an error midway does not lock the customer out.

By SDK, for partners. Software that wants to connect its own customers' numbers from inside its product uses the public API to generate the link and a JavaScript SDK to open the connection screen from its own button. The connection opens in a tab, not a pop-up, because Meta's window needs to open on top and Meta refuses a pop-up inside another pop-up.

In all three cases, after connecting the number answers the public API like any other. The first send is the one from the quickstart guide:

curl -X POST https://frameconexa.com/api/v1/instances/$FRAME_CONEXA_INSTANCE_ID/messages \
  -H "Authorization: Bearer fc_SEU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"to":"5585999990000","type":"text","text":{"body":"Olá!"}}'

And incoming messages are delivered to your system by signed webhook, as described in how to integrate the WhatsApp Cloud API with webhooks. Nothing that happens afterward depends on which of the three paths opened the window.

Next step

If the number is ready and the phone is in hand, connecting through the dashboard takes the minutes this article describes. See the per-number plans to choose between support and marketing, and the quickstart guide for the first send by code right afterward.