Notice: As of Sept 21, 2020, Twilio and WhatsApp have implemented a new process for ISV, SI and ISV/SI end customer onboarding. This new process is reflected below.
Independent software vendors (ISVs), system integrators (SIs) and other third parties that wish to integrate with WhatsApp for their customers must follow a specific process. This guide explains the procedure for setting up a WhatsApp integration with third parties. The following topics are covered:
- Who does this guide apply to?
- Implementation prerequisites
- Submit ISV for review by WhatsApp
- Register a WhatsApp Business Profile
- Approve Twilio's invitation
- Template approval
Click any of the above topics to skip directly to the corresponding content.
Who does this guide apply to?
This guide applies to anyone who is implementing WhatsApp Business API on behalf of their end client or a brand that they do not own. This includes any ISVs that wish to manage their customers' WhatsApp integrations in their own Twilio subaccounts or Twilio projects.
This does not apply to brands that set up WhatsApp on a Twilio account that is directly owned by them. For example, if Owl Shoe Store creates their own Twilio account and invites a systems integrator to that account to help with the WhatsApp integration, then this guide does not apply, as that's not considered an ISV setup.
Prior to requesting production access to WhatsApp, ISVs and their customers need to complete the following prerequisites:
ISVs: Create a subaccount
Twilio recommends that ISVs create one dedicated subaccount for each of their end clients. Subaccounts can be managed programmatically to keep accounts organized and separate billing concerns to provide cost transparency. For instructions, see View and create new Twilio subaccounts.
If you will be using Flex with WhatsApp, please have the Flex project created ahead of time. Each end client should have its own dedicated Flex project.
Customers and ISVs: Locate your Facebook Business Manager ID
Customers and ISVs must each have their own separate Facebook Business Manager account. This is not the Facebook page. The Facebook Business Manager ID ("FB BM ID") will be needed when submitting the request for access, as it is used by WhatsApp to identify your business. If you don't already have a Facebook Business Manager account, you must create one at business.facebook.com.
If you already have a Facebook Business Manager account, follow these steps to find the ID:
- Access the Business Settings page on Facebook Business Manager.
- Click Business Info.
- Your ID will be listed under "Business Information."
Submit ISV for Review by WhatsApp
All ISVs need to go through a separate, one-time sanctions and compliance review by WhatsApp.
ISVs: Submit a request for access for the ISV
To begin the process, an ISV must submit a request for access to WhatsApp for themselves, as a direct client, at the Request Access form.
On the Request Access form, the ISV should select the answer "Yes, I am an ISV or SI." for the question "Are you working with an ISV, SI, or third party?"
Use the ISV's own brand information, including Facebook Business Manager ID and parent Account Sid. This should be the same parent Account SID that is associated with any subaccounts that will be used for end client integrations.
While ISVs are not required to have an integration as a direct client, Twilio strongly recommends that all ISVs onboard onto WhatsApp directly. This allows ISVs to get a complete understanding of the process so they can guide their own customers.
ISVs: Wait for approval and next steps
Twilio will identify the ISV based on the "request access" form, and submit the ISV to WhatsApp for review. ISVs will receive an email to notify them that "Your ISV company has been submitted for review by WhatsApp." WhatsApp uses publicly available information to perform a sanctions and compliance review of the ISV company. Submissions to WhatsApp happen weekly and generally take 1-3 weeks for WhatsApp to complete.
Sign the ISV Terms and Accept the ISV Requirements
Once the review process by WhatsApp has been completed, Twilio will send separate "ISV Terms" for the ISV to sign and "ISV Requirements" to acknowledge. Both are sent to the email submitted in the ISV's "request access" form.
ISVs: Sign the ISV Terms
Twilio will send ISV Terms via Docusign. The terms must be signed by the ISV. These are provided by WhatsApp and enforced globally for ISVs working with any BSP.
ISVs: Accept the ISV Requirements
Notice: ISVs are prohibited from representing themselves as official resellers of WhatsApp. This includes using WhatsApp's brand without disclosing Twilio as a BSP, or charging separately for WhatsApp.
Twilio will send a Google Form containing "ISV Requirements" that must be accepted by the ISV. This form outlines additional ISV restrictions imposed by WhatsApp.
Onboard End Clients onto WhatsApp
Once Twilio has received a confirmed approval from WhatsApp for the ISV, the ISV Terms have been signed, and the ISV Requirements have been accepted, the ISV can proceed to onboard any number of clients by following the process below.
Notice: All ISVs that work with multiple clients must ensure this process is followed for each unique business. Approval for one brand cannot be applied to other companies.
ISVs or Client: Submit a request for access for each end customer
Each brand must be submitted separately to Twilio in order to gain access. To submit a request, please complete the form at twilio.com/whatsapp/request-access and make sure you select "Yes, this request is for a client working with an ISV or SI" for the question "Are you working with an ISV, SI, or third party?"
To avoid delays, please ensure the form is filled out as follows:
- All client information, such as company name and region, must correspond to the client’'s brand, not the ISV.
- Facebook Business Manager ID: Use the client’'s Facebook Business Manager ID, not the ISV's.
- Twilio Account SID: The account where WhatsApp numbers will be provisioned. This will be subaccount SID or Flex project SID. (Note: This is no longer the client’s account.)
- For the question: "Are you working with an ISV, SI, or third party?" Select: "Yes, this request is for a client working with an ISV or SI"
Notice: The client is no longer required to create a separate Twilio account.
ISV: Submit a WhatsApp Sender Profile and Send WA ToS to End Client
Once the end customer's access request has been reviewed, a pre-approval or denial email will be sent. For pre-approved requests, the ISV can now proceed to register the client.
End Client: Accept the WhatsApp Terms of Service
For pre-approved requests, Twilio will ask the ISV to send the WhatsApp Terms of Service to the end client. Each end client must accept the ToS. This is done by completing a separate Google Form. End clients that do not accept the ToS will not be allowed to launch in production.
ISV: Submit WhatsApp Sender Profile
The ISV can now submit a WhatsApp Sender in the subaccount that was created for their customer. The WhatsApp Sender is the WhatsApp number that's used to send and receive messages. Here's the process:
- Access the subaccount corresponding to the end customer in Console.
- Access the WhatsApp Enabled Senders page (Programmable Messaging > Senders > WhatsApp).
- Click the “Submit a WhatsApp Sender” button.
- Complete and submit the form. Make sure the display name is the customer's business name.
Notice: The Sender Display Name must match the name of the end customer's company to avoid rejection by Facebook. Please see the Facebook's Display Name rules.
Sender profile registration can take 3-5 days to be approved, depending on the volume of requests. If you are working with a Twilio Account Manager, ask them about the status of your request - they may be able to expedite your request.
End Client: Approve Twilio's request in Facebook Business Manager
Once a WhatsApp Sender has been submitted, the client will receive a notification in their Facebook Business Manager account from Twilio. The client must click to "approve" Twilio to message on their behalf. Here's the process:
- The client, not the ISV, must access the Business Settings page on Facebook Business Manager.
- Click Requests.
- Click "Approve" on Twilio's request.
End Client: Submit Business Verification on Facebook Business Manager
WhatsApp requires all companies to submit Business Verification in their Facebook Business Manager account. This only has to be done once for each client, but it is the longest part of the process. Average processing times by Facebook are 3-7 business days, but in some regions this can take up to 4 weeks. Here's the process:
- The end customer must access the Business Settings page on Facebook Business Manager.
- Click on Security Center.
- Click to Start the Business Verification process and complete Facebook's steps. For more info, refer to Facebook's help article.
ISV: Wait for Approval
Once Facebook has completed Business Verification, WhatsApp will review the client's business in accordance with their commerce policy. This process happens once per client and takes 3-5 days. Once this step is complete, Twilio will register the WhatsApp number and you will receive an email notification with the subject "Congratulations! Your Sender Profile is Registered". The sender will show as "approved" in the Twilio console and you will be able to use it in production.
ISV: Submit Message Templates for Approval
Outbound messages to any WhatsApp users that have not responded to you in at least 24 hours must be sent using a pre-approved message templates. These are generally transactional messages (delivery alerts, appointment reminders, etc.) sent to users who have opted in to receive messages from you.
Templates are managed in the customer's subaccount on the WhatsApp Templates page in Console. Here you can see previously approved templates, and submit approval requests for new templates (or additional language translations for existing templates). All templates apply to all approved WhatsApp Senders in the Twilio account.
For full details, see Creating messaging templates and submitting them for approval (Twilio Docs).