Embedded Signup

How Dualhook Uses Embedded Signup

Dualhook uses Meta's OAuth popup flow to create connections and fetch credentials.

The client-side flow calls FB.login(...) with:

• config_id — your Login for Business configuration
• response_type: "code" — returns an authorization code instead of a token
• override_default_response_type: true
• Extras including feature: "whatsapp_embedded_signup", sessionInfoVersion: "3", and featureType: "whatsapp_business_app_onboarding"

Dualhook listens for the popup's postMessage session info and captures:

• waba_id — the WhatsApp Business Account ID
• phone_number_id — the specific phone number ID

Server-Side Completion

After receiving the authorization code, Dualhook:

1. Exchanges the code for an access token using your app credentials. The result is a Business Integration System User access token — long-lived and scoped to the customer that completed onboarding (see WhatsApp Business API Permissions).
2. Calls debug_token to capture the system user ID and the granular OAuth scopes attached to the token (which WABA target_ids it has whatsapp_business_management and whatsapp_business_messaging access to).
3. Stores token lifecycle metadata (tokenIssuedAt, tokenExpiresAt) so Dualhook can warn before expiry.
4. Creates a connection draft or full connection.
5. Auto-subscribes webhook override (best effort).

Fallback Discovery

If the popup session info is incomplete (for example, the postMessage did not arrive), Dualhook falls back to Graph API discovery using the debug_token granular scopes captured above:

1. For each WABA target_id returned by debug_token, fetch WABA name and owner_business_info.
2. If granular scopes are empty, fall back to /me/businesses and enumerate owned WABAs.
3. Enumerate phone numbers under each candidate WABA.

If multiple WABAs or numbers are discovered, Dualhook presents the options and finalizes setup with your selection.

Common Failure Modes

• Popup blocked by browser — allow popups for Dualhook and retry.
• User cancels before code return — restart the connection flow.
• Token exchange failure — verify your app credentials and redirect_uri.
• No discoverable WABA/phone under granted access — confirm the correct Meta Business Portfolio was selected during the popup.