Going live

Before you swap the test key for a live one, walk through this list.

Your WhatsApp number#

A WhatsApp number is connected in Settings → WhatsApp numbers and shows as able to send.
Your templates are approved by WhatsApp. A template in review answers template_not_approved.

The 24-hour window. Free-form messages (text and other non-template types) are delivered only within 24 hours of the customer's last message. Otherwise send a template. The API checks this before sending and answers window_closed, so no message is lost silently.
Consent. Send business-initiated templates only to people who agreed to receive them. For a contact marked as not consented, the API asks for "consent_confirmed": true; each confirmation is recorded in the audit log.
Opt-outs. When a customer asks to stop, stop. Contacts who opt out are marked in the portal.
Quality and limits. WhatsApp limits how many new customers a number can message per day and watches block rates. Poor-quality sending lowers those limits.

Keys live in a secrets manager or environment variables, one key per integration, with only the scopes it needs.
Every POST carries an Idempotency-Key, and retries reuse it.
429 and 5xx are retried with exponential backoff; other 4xx are fixed, not retried.
You branch on error.code and log Request-Id.
Your webhook endpoint verifies signatures, answers within 15 seconds, and de-duplicates on webhook-id.
A live webhook endpoint exists: test endpoints never receive live events.

Watch Developers → Logs for errors and Developers → Webhooks for failed deliveries.
If a key leaks, revoke it immediately and create a new one.