Skip to content
01

Product boundary

Maxbot WhatsApp Integration is an add-on. It extends an installed and authorized Maxbot Core plugin; it does not replace the core builder.

Core owns agents, topics, entities, conversation blocks, Flow Editor logic, Users Data, training, and the project model. The add-on receives Meta webhook events, resolves the linked WhatsApp project and assigned flow, passes the message into Maxbot, and sends the resulting response through WhatsApp Cloud API.

Build in Core

Create and test the complete conversation,including keywords, fallbacks, validation, joins, and endings,before connecting the channel.

Connect in the Add-on

Configure Meta assets, webhook delivery, the linked project, production credentials, templates, testing, and channel-specific operations.

02

Prerequisites

  • An installed, active, and authorized Maxbot Core plugin.
  • A complete Maxbot topic/flow that already passes Test Flow.
  • The installable Maxbot WhatsApp Integration add-on ZIP.
  • A Meta developer account and a Business Portfolio.
  • A Meta app using the WhatsApp Business use case.
  • A public HTTPS WordPress site that Meta can reach.
  • Administrator access to WordPress and appropriate control of the Meta business assets.
Do not begin with production credentials. Validate the connection with Meta’s development assets first, then move deliberately to the real number and permanent token.
03

Install the WhatsApp add-on

  1. Confirm Maxbot Core is installed, active, authorized, and functioning.
  2. Open Plugins → Add New Plugin → Upload Plugin.
  3. Choose the installable WhatsApp add-on ZIP and select Install Now.
  4. Activate the add-on.
  5. Open Maxbot → WhatsApp Integration and confirm Settings, Templates, Dashboard/Logs, and Troubleshooting are available.
Dependency: do not deactivate or remove Maxbot Core while the add-on is active.
04

Setup map

  1. Create the Meta app and select the WhatsApp Business use case.
  2. Validate Meta’s test phone assets.
  3. Copy development credentials into Maxbot.
  4. Configure the callback URL, verify token, and messages subscription.
  5. Create and link a WhatsApp project to a tested Maxbot flow.
  6. Add the real business number and permanent system-user token.
  7. Run a two-way production test and inspect logs.
  8. Complete business verification and template approval when required.
05

Create the Meta app

  1. Open Meta for Developers and select My Apps → Create App.
  2. Enter an app name and contact email.
  3. Choose the WhatsApp Business use case.
  4. Select the Business Portfolio that should own the WhatsApp Business Account.
  5. Review the selection, create the app, and complete any confirmation Meta requests.
  6. On the app dashboard, add or customize the WhatsApp product and open its API Setup.
Create a dedicated Meta app owned by the correct Business Portfolio. Click to enlarge.
Select WhatsApp Business so the app receives the required Cloud API configuration. Click to enlarge.
06

Validate Meta development phone assets

  1. Open the WhatsApp product’s API Setup or Try it out area.
  2. Select Meta’s test sender number.
  3. Add a recipient number that you control and verify it when Meta requires confirmation.
  4. Send Meta’s sample message.
  5. Confirm it arrives before adding Maxbot to the path.
  6. Record the App ID, WABA ID, test Phone Number ID, and temporary access token shown for the development assets.
Isolation test: if Meta’s own sample does not arrive, fix the Meta asset or recipient setup before troubleshooting Maxbot.
Use Meta’s development sender and test recipient before configuring the Maxbot webhook. Click to enlarge.
Choose a recipient you can access so both outgoing delivery and incoming replies can be checked. Click to enlarge.
07

Credential reference

ValueSourcePurpose
App IDMeta app dashboardIdentifies the Meta app.
App SecretMeta app basic settingsValidates webhook signatures. Keep it private.
WABA IDWhatsApp API SetupIdentifies the WhatsApp Business Account.
Phone Number IDWhatsApp API SetupIdentifies the sender in Cloud API calls.
Access tokenTemporary token for development; system-user token for productionAuthorizes API requests.
Verify tokenCreated by you in MaxbotMust exactly match Meta’s webhook configuration.
Callback URLGenerated by MaxbotPublic HTTPS endpoint that receives Meta webhook events.
Identifiers must belong together. A WABA ID, Phone Number ID, app, token, and production phone drawn from different business assets can pass some checks while failing message delivery.
08

Enter development credentials in Maxbot

  1. Open Maxbot → WhatsApp Integration → Settings.
  2. Copy the App ID from the Meta app dashboard.
  3. Reveal and copy the App Secret from Meta’s basic app settings.
  4. Copy the WABA ID, development Phone Number ID, and temporary access token from WhatsApp API Setup.
  5. Paste each value into the matching Maxbot field without surrounding spaces or labels.
  6. Create a strong verify token that is not the App Secret or access token.
  7. Save the settings before configuring the webhook in Meta.
Temporary tokens expire. They are appropriate only for the development phase and must be replaced before production.
09

Configure the webhook

  1. In Maxbot WhatsApp settings, confirm the verify token and credentials are saved.
  2. Copy the callback URL generated by Maxbot.
  3. In Meta, open WhatsApp → Configuration and choose to configure the webhook.
  4. Paste the callback URL into Meta’s Callback URL field.
  5. Paste the exact same verify token.
  6. Select Verify and Save.
  7. In the webhook fields list, subscribe to messages.
Copy the HTTPS callback URL generated by Maxbot and keep its verify token saved. Click to enlarge.
Meta accepts the callback only when it can reach the site and both verify-token values match exactly. Click to enlarge.
10

Verify webhook delivery and app subscription

  1. Open WhatsApp Integration → Troubleshooting.
  2. Select Test Connection.
  3. If webhook delivery is disabled, enable it, save, and retest.
  4. Confirm the app, WABA, phone assets, callback, and subscription are detected.
  5. Confirm the WABA is subscribed to the app and the messages field is active.
  6. Send a Meta test message and reply from the recipient phone.
  7. Verify the incoming event appears in Maxbot’s logs.
Run the built-in test after saving credentials and subscribing Meta’s webhook. Click to enlarge.
A successful test confirms the main Meta and Maxbot integration checks. Click to enlarge.
11

Create a WhatsApp project

  1. In Maxbot Core, create and fully test the topic/flow that should answer WhatsApp messages.
  2. Open Projects and select Add New Project.
  3. Enter a project name and select the WhatsApp project/channel type.
  4. Assign the correct agent and conversation flow.
  5. Choose whether any incoming message or only specific messages can start the flow.
  6. For a specific-message trigger, enter keywords or phrases and choose Exact, Contains, or Starts with.
  7. Enable “only trigger if no active conversation exists” when a new trigger should not restart an ongoing session.
  8. Optionally configure a website WhatsApp launcher and prefilled message.
  9. Save and enable the project.
13

Add the production phone number

  1. In WhatsApp API Setup, select Add phone number.
  2. Enter the public display name, business category, and business description.
  3. Enter the real phone number.
  4. Complete Meta’s verification method for that number.
  5. Select the new number in API Setup.
  6. Copy its Phone Number ID and confirm the WABA ID belongs to the same business account.
Add and verify the production phone number under the same business assets used by the app. Click to enlarge.
14

Create a permanent system-user token

  1. Open Meta Business Settings.
  2. Create or select a system user controlled by the business.
  3. Assign the Meta app and WhatsApp Business Account assets.
  4. Grant only the WhatsApp permissions required to manage and send messages.
  5. Generate a system-user token for the app.
  6. Copy the token immediately and store it in the business’s approved secret manager.
Permanent does not mean public. Never place the token in screenshots, support tickets, chat messages, frontend JavaScript, or source control. Rotate it after suspected exposure or ownership changes.
15

Replace test credentials with production values

  1. Open Maxbot WhatsApp settings.
  2. Replace the temporary token with the system-user token.
  3. Replace the test Phone Number ID with the production Phone Number ID.
  4. Confirm the App ID, App Secret, and WABA ID match the production number’s assets.
  5. Enter the public business number in international format.
  6. Save the settings.
  7. Run Test Connection and confirm the detected number, WABA subscription, webhook, linked project, and assigned flow.
Retest after replacing development assets so the result identifies the real business number. Click to enlarge.
16

Run an end-to-end production test

  1. Open WhatsApp Integration Troubleshooting and confirm every connection check passes.
  2. Enter a recipient number using digits in international format.
  3. Select an approved template and send the test message.
  4. Confirm the message arrives on the recipient phone.
  5. Reply with text that matches the configured project trigger.
  6. Confirm the linked project starts its assigned Maxbot flow.
  7. Complete quick replies, keyword routes, validation, media, joins, and the final action that the flow uses.
  8. Verify webhook-received, sent, delivered, and read events in Dashboard or Message Logs where available.
  9. Repeat from a second WhatsApp account and after any credential, webhook, template, project, or flow change.
Send a controlled test message, reply from WhatsApp, and verify the complete two-way path. Click to enlarge.
17

Meta business verification

Meta may require Business Verification before production access or higher messaging limits are available.

  1. Open Meta Business Settings or Security Center and start verification.
  2. Enter the legal business name, address, phone, website, business type, and category exactly as official records show them.
  3. Add a trading name only when the business genuinely uses it.
  4. Choose an available verification method.
  5. Upload a current, readable file of the exact document type Meta requests.
  6. Review and submit the information.
  7. Monitor the verification status and account email for follow-up requests.
  8. After approval, confirm the app, WABA, production number, display name, and system-user assets still match.
18

WhatsApp template basics

WhatsApp message templates are created for defined business-initiated messages and reviewed by Meta. A template has a unique name, language, content, components, samples, and a status.

  • Use clear content that matches the real business purpose.
  • Provide realistic samples for variables and media.
  • Use only publicly accessible HTTPS sample media.
  • Do not place a Pending or Rejected template in a production flow.
  • Keep the live payload compatible with the approved structure.
21

Approval and template statuses

  1. After submission, confirm the template appears in Maxbot with Pending status.
  2. Open Meta Message Templates and locate the same name and language.
  3. Wait for Meta’s review; do not create duplicate copies while the template is pending.
  4. When review finishes, return to Maxbot and select Refresh Template Statuses.
  5. Use the template only after Maxbot reports Approved.
  6. If it is Rejected, inspect Meta’s reason, correct the content or samples, and submit a revised template.
23

Dashboard and message logs

Use Dashboard and Message Logs to reconstruct the message path:

  • Whether Meta delivered the incoming webhook.
  • Which sender and phone-number asset produced the event.
  • Whether Maxbot resolved the linked project and active conversation.
  • Which flow and block handled the input.
  • Whether the outgoing request reached sent, delivered, read, or failed status.
  • Any sanitized error code and timestamp needed for troubleshooting.
Support data: share timestamps, status labels, and sanitized errors,never access tokens, App Secrets, verify tokens, or private message content.
24

Security

  • Use HTTPS for WordPress and the webhook endpoint.
  • Keep the App Secret and access token private.
  • Validate Meta’s App Secret signature on incoming webhook requests.
  • Use a strong, unique verify token.
  • Use a system-user token with only the required assets and permissions.
  • Restrict WordPress administrator and Meta Business access.
  • Rotate credentials after staff, ownership, permission, or exposure changes.
  • Keep WordPress, Maxbot Core, the add-on, and server dependencies updated.
25

Troubleshooting

ProblemWhat to check
Add-on activation failsMaxbot Core must be installed and active. Upload the installable add-on ZIP and verify server compatibility and dependencies.
Webhook verification failsThe callback must be public HTTPS; save Maxbot first; both verify-token values must match exactly; security or cache layers must not block Meta’s verification request.
Connection works but no incoming replyCheck the messages subscription, App Secret, WABA/number pairing, webhook delivery, linked project, assigned flow, enabled state, trigger match, and active-conversation option.
Test message does not arriveUse international digits, the correct Phone Number ID and token, an approved template, and a recipient active on WhatsApp.
Token or authorization errorReplace expired development credentials, confirm the system user’s permissions and assigned assets, and regenerate the production token when necessary.
Wrong flow startsConfirm the Linked WhatsApp Project, project type, assigned flow, trigger keywords, match type, and whether an active conversation already exists.
Template stays Pending or is RejectedInspect Meta’s status and reason, verify sample media accessibility and valid content, refresh statuses, then correct and resubmit when needed.
Carousel sends incorrectlyUse an Approved template, match the approved card count and structure, supply all production card fields, and use only the suffix for a Link Carousel with a base URL.
26

Production launch checklist

  • Maxbot Core and the WhatsApp add-on are active, authorized, and current.
  • The core flow passes all expected, fallback, validation, join, and ending tests.
  • The production phone number is registered and its display name is approved.
  • The App ID, App Secret, WABA ID, Phone Number ID, public number, and system-user token belong to matching production assets.
  • The callback uses HTTPS, App Secret signature validation is enabled, and the verify token remains private.
  • The messages subscription and WABA app subscription are active.
  • The WhatsApp project is enabled, linked, and assigned to the intended flow.
  • Every live template reports Approved and its payload matches the approved structure.
  • Two-way tests from at least two recipient accounts succeed and appear in logs.
  • Token storage, staff access, privacy, logging, and escalation procedures are documented.
27

Retire or uninstall the integration

  1. Back up relevant project, template, and message-log information according to the business’s retention policy.
  2. Disable the linked WhatsApp project so it stops starting new conversations.
  3. Remove or disable Meta webhook subscriptions when the integration is permanently retired.
  4. Revoke the system-user token and remove unnecessary app/business asset assignments.
  5. Review the add-on cleanup setting, then deactivate and remove the add-on.
  6. Keep Maxbot Core installed when other web or channel projects still use it.
Return to Maxbot Core documentation