Quick answer: WhatsApp Business API access is either through Meta's Cloud API (hosted by Meta) or through a Business Solution Provider (BSP) that resells API access with additional tooling. Either path requires a Meta Business Account, Business Verification, a WhatsApp Business Account (WABA), a registered phone number and display name, optional green-tick application, and the message-template / consent flow. End-to-end a clean setup takes seven calendar days of work spread across two to four weeks of waiting on Meta.
WhatsApp Business API is no longer the niche tool it was in 2020. For Indian businesses especially — where WhatsApp is the dominant messaging app — the API has become the channel that decides customer experience for everything from order updates to lead handling to support. The setup is more bureaucratic than technical, and the bureaucracy trips up most first-time implementations.
In plain language: WhatsApp Business API is accessed either directly through Meta's Cloud API (hosted by Meta) or through a Business Solution Provider (BSP) that resells API access with additional tooling. Either path requires you to set up a Meta Business Account, complete Business Verification, create a WhatsApp Business Account (WABA), register a phone number and display name, optionally apply for the green tick (Official Business Account), and then implement message templates for outbound, session messages for inbound, and the consent flow.
Cloud API vs BSP — which to pick
| Dimension | Meta Cloud API | BSP |
|---|---|---|
| Hosting | Meta hosts the API | BSP hosts (some on Cloud API, others on legacy) |
| Pricing | Meta's published rates | BSP markup over Meta rates + platform fee |
| Tooling | Bare API; you build the rest | UI, campaigns, automation, chatbot builders out of the box |
| Speed to deploy | Slower (you build infrastructure) | Faster (UI ready) |
| Control | Maximum | BSP-dependent |
| Best for | Tech teams with engineering capacity, large volumes | Marketing teams without engineering, low-to-mid volume |
Common BSPs in India: Gupshup, AiSensy, Wati, Interakt, Yellow.ai, Twilio (which also offers Cloud API access). Meta also maintains a list of official BSPs.
[VERIFY 2026] WhatsApp deprecated the on-premise API and consolidated on Cloud API; confirm the current state and the BSP landscape before publishing.
The 7-day setup plan
Day 1 — Meta Business Account + Business Verification
- Create a Meta Business Account at business.facebook.com (if you don't already have one)
- Add your business details, website, address
- Initiate Business Verification — Meta verifies your business via documents (business license, address proof, tax registration). This step is the slowest in the whole plan; submit early.
Business Verification can take days to weeks. Submit on Day 1 and proceed with the other steps while you wait.
Day 2 — WhatsApp Business Account (WABA) + Phone Number
- Inside your Meta Business Manager, create a WhatsApp Business Account
- Add a phone number. The number must:
- Be a phone number you own and can receive verification on
- Not be already used in the WhatsApp consumer app (or be migrated)
- Not be a virtual / temporary number from a VoIP provider that fails verification
- Verify the number via the OTP / call Meta sends
Day 3 — Display name + profile setup
- Set the display name (the name your customers will see). This is also reviewed by Meta and must comply with WhatsApp's commerce policies (no misleading names, no all-caps, no special characters per the policy)
- Add the business profile: logo, description, business category, website, business hours
- Set the profile photo (most easily a square logo)
Day 4 — Pick your path: Cloud API or BSP
- If Cloud API: get an access token, configure webhooks to your endpoint, validate the test message
- If BSP: complete BSP onboarding, connect the WABA to the BSP, configure their platform
Day 5 — Message templates
WhatsApp distinguishes between:
- Marketing templates — promotional messages, requires explicit opt-in, the most-priced category
- Utility templates — transactional / service messages tied to user actions (order confirmation, shipping update)
- Authentication templates — OTPs and similar
- Service templates — customer-initiated session responses; the lowest-priced category
Register the templates you need. Each is reviewed by WhatsApp:
- Names, variable structure, message content
- Categorisation must match content; mis-categorisation gets the template rejected
- Buttons (URL, quick reply, phone call) configured at registration
- Media support (image, video, document headers)
Day 6 — Webhooks and inbound message handling
For inbound messages:
- Configure your webhook endpoint to receive incoming messages
- Implement the 24-hour session window logic — within 24 hours of a customer-initiated message, you can reply with free-form messages; outside the window you must use templates
- Implement message status handling (sent, delivered, read, failed)
- Implement opt-out handling (when a user replies with "STOP" or similar)
Day 7 — Consent flow and go-live
For outbound messaging:
- Implement the explicit opt-in flow for marketing templates (web form, in-app toggle, etc.)
- Suppress numbers without consent
- Document consent timestamps and channels
- Send a low-volume initial campaign to verify deliverability and webhook handling
- Monitor for the first 48 hours; ramp up volume gradually
The green tick (Official Business Account)
The green checkmark next to your business name signals verification. Applying involves:
- Demonstrating notability — media coverage, third-party verification, brand prominence
- Higher-tier review by Meta
- Approval not guaranteed even for legitimate businesses
For most businesses the green tick is a "nice to have, apply later" — don't block launch on it.
Pricing primer
WhatsApp pricing is conversation-based and varies by category and country. India rates are some of the most-discussed in the world due to volume. See our companion article on WhatsApp marketing pricing for the full breakdown.
Common setup mistakes
- Submitting Business Verification with mismatched documents — delays the whole plan by weeks
- Using a number that's still active on consumer WhatsApp — must be migrated or fresh
- Display name that violates the commerce policy — gets rejected; resubmit
- Template categorisation wrong — rejected and counts against your account quality
- No consent flow for marketing — eventual user reports, quality rating drops
- Ignoring the 24-hour session window — you try to send free-form outside it and the message fails
What this realistically takes
End-to-end, a clean WhatsApp Business API setup takes seven calendar days of work spread across two to four weeks of waiting on Meta. Business Verification is the single longest gating step. Plan accordingly.
CTA: OpenMalo's WhatsApp Business module ships with the BSP integration, template management, consent capture, session window handling, and webhook infrastructure pre-built. See the module →
Closing
WhatsApp Business API setup is more permission than engineering. Submit your Business Verification on day one, parallel-track the rest, and don't underestimate how badly a small mistake in display name or template categorisation can set you back. Build the consent and session logic right the first time — it's the difference between a 4.5-quality-rating account that compounds and a 2.5-rating account that limits your reach.
