Why does my token keep expiring?

You're likely using a short-lived token (a couple of hours). Switch to a long-lived system-user token (~60 days).

Why does it work in the API Setup tool but not my backend?

The tool is usually using a different token/asset/business context than your server.

WhatsApp Error 190: Access Token Expired Fix

WhatsApp/Graph Error 190: Access Token Expired

WhatsApp/Graph error 190 means your access token expired or is invalid. Why it happens and how to switch to a long-lived system-user token.

TL;DR: Error 190 means the connection's underlying Meta authorization expired or was invalidated (HTTP 401). Reauthorize the connection through Embedded Signup. Dualhook stores customer-scoped BISU tokens encrypted and does not reveal or refresh them with the ordinary System User flow.

What Error 190 Means

Meta's details string is: "Your access token has expired." A common variant is "Error validating access token: Session has expired…". In practice 190 covers authorization that is expired, invalid, or no longer valid for the target asset. Dualhook records the expiry metadata Meta returns and requires reauthorization if an existing BISU token expires; it does not apply the ordinary System User refresh diagram to BISU tokens.

Where You See It

An immediate API error (HTTP 401) on any Graph/Cloud API call — message sends, WABA queries, template APIs, subscription/config APIs. It blocks the request, so it is not delivered via the message status webhook.

Common Causes

A short-lived/temporary quickstart token used in production.
The token's session changed or the token was revoked.
App or business-asset permissions were removed.
The live backend points at a different business asset than the token can access.

How to Fix It

Check the connection Health tab to confirm the authorization failure.
Reauthorize the existing connection through Embedded Signup.
Confirm the refreshed connection has access to the correct WABA and phone number.
Create or rotate the connection's dh_live_... key if your sending backend needs a new Dualhook credential, then re-test the failing call.

How to Prevent It

Use the customer-scoped BISU authorization created through Embedded Signup, never a console temporary token, in production.
Track any expiry Meta reports and reauthorize before it is reached.
Re-validate asset assignments after business/admin changes.

/docs/whatsapp-error-131031 — account locked
/docs/whatsapp-error-100-webhook-override — subscribe before override
/docs/whatsapp-error-80007 — WABA rate limit
See the full error reference

FAQ

What is WhatsApp error 190? Your access token expired or was invalidated; the API returns 401.

Why did the authorization expire? An older connection may use an expiring authorization. Reauthorize it through the current Embedded Signup configuration.

Which permissions do I need? whatsapp_business_management and whatsapp_business_messaging.

Why does it work in Meta's API Setup tool but not my backend? The tool uses a different credential and asset context. Your backend should use its connection-bound dh_live_... key with api.dualhook.com.

How Dualhook Helps

Token and authorization health is an account/platform concern where Dualhook genuinely helps. Because Dualhook connects your WABA via Meta Embedded Signup and holds advanced access to whatsapp_business_management and whatsapp_business_messaging, it can surface connection/authorization health and alert you when a WABA's authorization drops. Your sending backend authenticates to Dualhook with a connection-bound dh_live_... key; the underlying Meta token stays encrypted on Dualhook's server. See Runtime API Authentication, Maintain Account Health, and Messaging Health Status.