XONTAINERLogistics ecosystem
First: whose job is each step?
Part of the setup can only be done by the company itself, because the account, business verification and number ownership legally belong to the company. The technical connection can be automated.
- The company’s job: Meta Business account, business verification (tax and company documents), number ownership, submitting the display name for approval, payment method.
- What can be automated: app connection, webhook, template drafts, connecting the line to the transport or warehouse system, verification tests.
- Rule: no passwords are shared; whoever does the setup is added to the company’s Meta Business account as a partner, and access is removed when the work is done.
Step 1: Meta Business account and business verification
A Meta Business account is opened in the company’s name and submitted for business verification. Verification can take several days; other preparation continues meanwhile. The company name, address and website details must match the official documents; mismatches are the most common reason for rejection.
Step 2: Number and display name
A separate number is usually used for the API: in the classic setup the number cannot be registered in the WhatsApp app on a phone at the same time. In some countries Meta also offers limited coexistence with the Business app on the same number; check the current situation during setup. The display name (what the customer sees as the chat title) goes through Meta approval and must be consistent with the brand. Several lines (for example sales and operations) are added and approved one by one.
Step 3: App, access token and webhook
The technical connection runs through a Meta developer app. A permanent system-user token is created and limited to the permissions that are needed. Incoming messages reach the system through a webhook; the webhook signature must be verified on every request. The token stays on the company’s server or in a secrets vault and is never shared by email or chat.
Step 4: Templates and the 24-hour rule
You can send any message during the 24-hour window that opens with the customer’s last message. After that window closes, only templates approved by Meta can be sent. Templates are approved by category: marketing, utility and authentication. Trip updates, appointments and document reminders fall under utility templates; Meta may move a template with marketing language into the marketing category.
Step 5: Verification (verified, not just installed)
The setup ends with a real end-to-end test. Recommended checks:
- Does a message from a test number reach the system and attach to the right record?
- Does the welcome or automatic reply go out, and does the office get a notification?
- Is the webhook signature verified, and is a forged request rejected?
- Does sending stop when the customer writes “STOP”?
- Is the test record then deleted in a controlled way?
What WhatsApp cannot do
Knowing the limits before a sales conversation avoids disappointment later. Limits observed as of November 2026:
- Over WhatsApp, a business can only call people who use WhatsApp and have allowed calls from that line; a regular phone line cannot be called through WhatsApp. In our observation a business number also cannot be added to a group call; conference or interpreter calls may need a separate telephony provider. At Afillo this path is being prepared. Calling may not be available in every country.
- Outside the 24-hour window, free text cannot be sent; only approved templates.
- Display name and templates depend on Meta approval; Meta does not commit to an approval time.
- Meta’s rules change often; the information on this page reflects the page date.
Privacy and retention
WhatsApp messages pass through Meta’s infrastructure and may be transferred outside Türkiye or the EU; this must be stated clearly in the privacy notice. A customer writing to you can be enough to answer that request; business-initiated messages, and marketing in particular, need separate explicit consent. Setting a short retention period (for example 1 year) for conversations that do not lead to a contract is good practice. This page is not legal advice; consult your legal adviser for your own case.