Business messaging integration

Client brief and onboarding checklist · Last updated: 13 August 2026

This page covers custom integrations built on the WhatsApp Business Platform (Cloud API), from Meta. It sets out what you need in place before development can start, who owns what, what Meta charges, and how long the approvals take.

Yorsh is an independent developer

Yorsh is an independent software developer. Yorsh is not affiliated with, endorsed by, sponsored by, or a partner or reseller of Meta Platforms, Inc. or WhatsApp LLC. We build integrations against Meta’s publicly documented API, on accounts that you own and control.

Who this is for

You are considering a custom integration that sends or receives messages programmatically — order updates, appointment reminders, one-time codes, support conversations routed into a system your team already uses.

Most of the work below is yours rather than ours. Meta requires the business that owns the messaging account to complete verification, supply a phone number, and get message templates approved. None of that can be delegated to a developer, and all of it takes calendar time. Working through this checklist before we scope the build is what keeps a project from stalling.

What the Cloud API is, and what it is not

Meta offers two distinct products. The free app installed on a phone is not the same thing as the API, and choosing correctly matters because moving between them is disruptive.

Comparison of the free business app and the Cloud API
The free business app	The Cloud API
Runs on a phone, operated by hand	Runs on a server, driven by your systems
One or a few linked devices	No device; any number of concurrent agents
No integration with your other software	Integrates with a CRM, database, or helpdesk
Free to use	Meta charges per message, by category
No verification or approvals	Business verification, display name review, and template approval all required

If your team answers messages manually and nothing needs to connect to another system, the free app is the right answer and this brief does not apply to you. The API earns its overhead when messages have to be generated, routed, or recorded automatically.

Who owns what

This is the most important commercial point on the page, so it is worth stating plainly: you own everything. The accounts are created under your business, billed to your payment method, and remain yours if our engagement ends.

Division of ownership between client and Yorsh
You own and control	Yorsh receives
The Meta Business Portfolio	Scoped developer access to the app and messaging account
The messaging account and its phone number	Nothing that outlives the engagement
The display name and approved templates	—
The payment method — Meta bills you directly	—

We never take administrative ownership of your accounts, never ask for a personal login, and never place ourselves between you and Meta for billing. Access we hold is scoped to what the build requires and can be revoked by you at any time, from your own account settings.

What it costs

There are two separate costs, and they are paid to two different parties.

Meta charges you directly, per message. Since 1 July 2025 billing is per delivered message rather than per conversation. Messages fall into four categories, and the rate varies by category and by the recipient’s country:

Marketing — promotions and offers. The most expensive category, deliberately so.
Utility — updates tied to an action the customer took, such as an order confirmation or a delivery notice.
Authentication — one-time passcodes and login codes.
Service — your replies inside the 24-hour window opened when a customer messages you. Free.

Rates change and vary widely between countries, so we do not reproduce them here. Check Meta’s current pricing documentation for the markets you will be messaging, and budget from your own expected volume.

Yorsh charges separately for the build. Our fee covers design, development, testing, and handover, and is quoted per project against an agreed scope. It is unrelated to your message volume, and we take no margin on Meta’s charges.

How long it takes

The approvals are sequential and mostly outside anyone’s control. Plan for the following, in this order:

Business verification — typically a few business days once documents are submitted, longer if anything mismatches.
Phone number and display name review — usually quick, but a rejected display name means resubmitting and waiting again.
Template approval — commonly within a day or two per template. Rejections are routine and are part of the process, not a sign something has gone wrong.
The build — depends entirely on scope, and can run in parallel with the approvals above.

The practical implication: start the account and verification steps immediately, even before the build is scoped.

The checklist

Forty-one items across six phases. Work through them in order — later phases depend on earlier ones clearing.

Your ticks are saved in this browser only. Nothing is sent to Yorsh or to anyone else — this page has no account, no server, and no analytics. Clearing site data for this domain erases them, and the checklist will not follow you to another browser or device.

1. Before we start

Confirm your industry is permitted Meta’s Commerce and Business Messaging policies prohibit several categories outright, including alcohol, tobacco and vapes, gambling, weapons and ammunition, drugs including prescription medication, adult products, and live animals. Financial services face extra restrictions. Check the Business Messaging Policy before anything else — this is the one gate that cannot be worked around.
Confirm you need the API rather than the free app See the comparison above. If nothing needs to be automated or integrated, the free app is cheaper and faster.
Write down the business outcome you are buying “Cut no-shows”, “stop staff copying orders by hand”, “answer out of hours”. This drives every design decision that follows.
List the message types you will send Notifications, support replies, one-time codes, marketing. Each maps to a pricing category and to a different set of policy rules.
Estimate monthly volume for each message type Needed to forecast Meta’s charges, and to judge whether the integration pays for itself.
List the countries you will be messaging Rates differ substantially by country, and some consent rules are jurisdiction-specific.

2. Meta account and ownership

Create or identify your Meta Business Portfolio It must belong to your business, not to an agency or to us. If an agency already holds one on your behalf, resolve that before going further.
Check the legal entity name matches your registration documents exactly A mismatch between the portfolio name and the documents is the single most common cause of verification failure.
Gather verification documents Typically a certificate of incorporation or registration plus proof of address such as a utility bill or bank statement. The business name and address must agree across all of them.
Complete Meta Business Verification Until this clears you are capped at a low daily limit and cannot progress to higher tiers.
Create the messaging account inside your portfolio Created under your portfolio so ownership is unambiguous from the start. Retrofitting ownership later is painful.
Add a payment method Meta bills you directly. Messages stop sending if billing fails, so use a card that will not expire mid-project.
Grant Yorsh scoped access Assign roles on the app and messaging account only. Never transfer admin ownership, and never share a personal login — with us or with any other developer.
Agree who holds the production access token, and where This credential can send messages as your business. Decide custody and rotation before one is generated, not after.

3. Phone number and display name

Choose a dedicated phone number your business controls It must be able to receive an SMS or a voice call to complete verification.
Confirm the number is not already registered, and deregister it if it is One-way door. A number currently active on the consumer app or the free business app must be removed from it first, and doing so deletes that number’s existing chat history. Export anything you need to keep before you start.
Do not use a personal number or one already in daily use Once a number is on the API it can no longer be used in the ordinary app on a handset.
Choose a display name that matches your business Meta reviews it against your verified business name or a brand clearly associated with it. Generic descriptions and unrelated names get rejected.
Complete number verification and display name review

4. Policy and consent

Publish a privacy policy at a public URL Required by Meta, and linked from your business profile. It must actually describe how you handle message data.
Design a documented opt-in It must name your business and make clear the person is agreeing to receive messages from you. Capture the timestamp and the wording shown at the time — if a complaint is ever raised, this record is your defence. See Meta’s opt-in guidance.
Confirm the opt-in satisfies local law, not only Meta’s rules Meta’s policy is a floor, not a ceiling. The LGPD in Brazil, the GDPR and ePrivacy rules in Europe, and the TCPA in the United States each impose their own requirements. Take your own legal advice on this.
Provide an opt-out, and wire it to your source of truth An opt-out that is recorded but not honoured is worse than none. Whatever system decides who gets messaged must read the same flag the opt-out writes.
Decide how long message content and consent records are kept
Confirm a lawful basis for the personal data reaching your systems Phone numbers and message content are personal data. If you keep a processing record, the integration belongs in it.

5. Technical setup

Provide a publicly reachable HTTPS endpoint for webhooks Valid certificate, reachable from the public internet. Inbound messages and delivery receipts arrive here.
Validate the signature on every inbound request The endpoint is public, so anyone can post to it. Without signature verification the integration will act on forged messages.
Decide where the integration runs, and who pays for it
Provide secret storage for the access token Never in source control, never in a spreadsheet, and rotatable without a redeploy.
Create a system user with the required permissions A system user token, not a personal one, so access does not break when a staff member leaves.
Identify the systems messages must flow into or out of CRM, helpdesk, database, spreadsheet. We will need access or API credentials for each, and a field mapping.
Decide how media is handled, if you send or receive files Images, documents, and audio need somewhere to live, and Meta only retains them briefly.
Agree how duplicate and retried webhooks are handled Webhooks can be redelivered. Without idempotency a redelivery becomes a duplicate order, a double charge, or a repeated notification.
Agree logging, error alerting, and who responds A silent failure in a messaging integration is invisible until a customer complains.

6. Templates, testing, and go-live

Draft your templates and assign each a category Any message you send outside an open conversation window must be a pre-approved template. Categorising a marketing message as utility to save money gets it recategorised or rejected.
Submit templates for approval, and expect some rejections
Test end to end against a test number before any real customer is messaged
Understand your starting messaging limits New accounts begin capped at a small number of unique contacts per day. Verification raises it, and the tier climbs from there based on volume and quality. Do not plan a launch campaign that assumes an unlimited tier on day one — see Meta’s messaging limits.
Understand the 24-hour customer service window When a customer messages you, you can reply freely for 24 hours at no charge. After it closes, you can only send an approved template, and it is billed. This shapes how support workflows must be designed.
Agree who monitors quality rating, and what happens if it drops Blocks and reports from recipients lower your rating, which lowers your sending limit and can suspend the number. It is a business problem before it is a technical one.
Agree handover, documentation, and the support period Set out in the scope document for the engagement, per our Terms of Service.

What we need in order to quote

You do not need the whole checklist finished before talking to us — phases 1 and 2 are usually enough to scope accurately. To give you a realistic number we need:

The business outcome, and the message types that serve it
Estimated monthly volume per category, and destination countries
The systems the integration must connect to, and their APIs
Whether business verification is already complete
Any deadline the launch is tied to

Send those to hello@yorsh.co and we will come back with a scope and a fixed quote.

Start a project

Notices

Trademarks

WhatsApp is a trademark of WhatsApp LLC. Meta is a trademark of Meta Platforms, Inc. These marks are referenced on this page solely to identify the platform this document describes. Yorsh claims no rights in them and no association with their owners.

No affiliation

Yorsh is an independent software developer. Yorsh is not affiliated with, endorsed by, sponsored by, or a partner or reseller of Meta Platforms, Inc. or WhatsApp LLC, and does not hold any partner, provider, or reseller status conferred by them.

Guidance only, and perishable

This page summarises requirements published by Meta as at the date at the top of the page. Meta changes its policies, pricing, approval criteria, and limits frequently and without notice, and the current official documentation always governs. Nothing here is legal advice — take your own on consent, data protection, and marketing law in the markets you operate in.