App-Only Install

Updated: Jun 28, 2026

Embedded signup v2 will be deprecated on October 15, 2026. Migrate your integration to v4 before that date to avoid disruption. See Versions for the full upgrade path.

You can configure Embedded Signup so that only business tokens can be used to access assets owned by customers onboarded via the flow. This approach scopes access to the customer's assets rather than relying on system tokens, simplifies onboarding for other Meta assets, and supports a larger number of onboardings. Because a business token grants access only to a specific customer's assets, a compromised token affects fewer assets.

App-Only Install can't be used to onboard WhatsApp Business app users.

Enabling the feature in Embedded Signup v3

To enable this feature, set features to app_only_install in the Embedded Signup configuration.

{  
  "config_id": "<CONFIGURATION_ID>",  
  "response_type": "code",  
  "override_default_response_type": true,  
  "extras": {  
    "version": "v3",  
    "features": [  
      {  
        "name": "app_only_install"  
      }  
    ]  
  }  
}

To enable this feature along with a Multi-Partner Solution:

{  
  "config_id": "<CONFIG_ID>",  
  "response_type": "code",  
  "override_default_response_type": true,  
  "extras": {  
    "version": "v3",  
    "features": [  
      {  
        "name": "app_only_install"  
      }  
    ],  
    "setup": {  
      "solutionID": "<SOLUTION_ID>"  
    }  
  }  
}

When a business customer successfully completes the flow, the session logging message event has event set to FINISH_GRANT_ONLY_API_ACCESS:

{  
  data: {  
    phone_number_id: "<CUSTOMER_BUSINESS_PHONE_NUMBER_ID>",  
    waba_id: "<CUSTOMER_WABA_ID>",  
    business_id: "<CUSTOMER_BUSINESS_ID>",  
  },  
  type: "WA_EMBEDDED_SIGNUP",  
  event: "FINISH_GRANT_ONLY_API_ACCESS",  
}

When a business customer successfully completes the flow, you receive an account_update webhook with event set to PARTNER_APP_INSTALLED.

{  
  "entry": [  
    {  
      "id": "<PARTNER_BUSINESS_ID_1>",  
      "time": "<WEBHOOK_TRIGGER_TIMESTAMP>",  
      "changes": [  
        {  
          "value": {  
            "event": "PARTNER_APP_INSTALLED",  
            "waba_info": {  
              "waba_id": "<WABA_ID>",  
              "owner_business_id": "<WABA_OWNER_BUSINESS_ID>",  
              "partner_app_id": "<APP_ID>",  
              "solution_id": "<SOLUTION_ID>",  
              "solution_partner_business_ids": [  
                "<PARTNER_BUSINESS_ID_1>",  
                "<PARTNER_BUSINESS_ID_2>"  
              ]  
            }  
          }  
        }  
      ],  
      "field": "account_update",  
      "object": "whatsapp_business_account"  
    }  
  ]  
}

If an onboarded business customer uses Meta Business Suite⁠ to uninstall/remove the app, an account_update webhook is triggered with event set to PARTNER_APP_UNINSTALLED.

{  
  "entry": [  
    {  
      "id": "<PARTNER_BUSINESS_ID>",  
      "time": "<WEBHOOK_TRIGGER_TIMESTAMP>",  
      "changes": [  
        {  
          "value": {  
            "event": "PARTNER_APP_UNINSTALLED"  
          },  
          "field": "account_update"  
        }  
      ]  
    }  
  ],  
  "object": "whatsapp_business_account"  
}

You can use the System User Access Tokens API to get an onboarded business customer's business token.

curl -i -X POST "https://graph.facebook.com/v22.0/<CUSTOMER_BUSINESS_PORTFOLIO_ID>/system_user_access_tokens  
  ?appsecret_proof=<APPSECRET_PROOF_HASH>  
  &access_token=<ACCESS_TOKEN>  
  &system_user_id=<SYSTEM_USER_ID>  
  &fetch_only=true"