Keep Meta access tokens and account identifiers out of chats, blog content and public website settings.
Use the right setup screen
The vhatsapp Business API configuration is intended for your Meta account details, including the access token and Phone Number ID. Prepare your Meta setup first. Do not put those values into a public CMS setting, website enquiry or support message.
Separate content and account access
Marketing pages can explain your product without exposing how an account authenticates. A public page needs a plan description, not an API secret. Use the configuration form for credentials and limit access to the people responsible for maintaining the connection.
Document ownership and changes
Record who manages the Meta account and which business number the configuration belongs to. When a token or account setting changes, review the connection and run an authorised controlled test. A saved form alone does not prove that a complete sending workflow is ready.
Respond to accidental exposure
If a credential is shared in the wrong place, use the provider account controls to replace or revoke it and review access. Remove the exposed value from public content where possible. Ask for help without sending the credential itself. Safe setup should not depend on sharing secrets in chat.
Explore vhatsapp plans or ask the team about your workflow.
