WhatsApp Setup (Cloud API)

Connect your agent to a WhatsApp Business number through the official WhatsApp Cloud API. For a personal number instead, see WhatsApp Web.

What You Need

Create a Meta for Developers app with the WhatsApp product added, then gather:

  • Phone number ID – the ID of the business phone number (WhatsApp > API Setup).
  • Access token – a permanent system-user token with whatsapp_business_messaging.
  • Verify token – a string you choose; Lenno echoes it during webhook verification.
  • App secret – your Meta app secret, used to validate inbound webhook signatures.
  • WABA ID (optional) – the WhatsApp Business Account ID.

Connecting to Lenno

  1. Go to your agent’s Channels tab.
  2. Click Add Channel and select WhatsApp.
  3. Enter the Phone number ID, Access token, Verify token, and App secret.
  4. Click Save. Lenno shows the webhook URL to register.

Configuring The Webhook

  1. In your Meta app’s WhatsApp > Configuration, set the callback URL to the Lenno webhook endpoint and paste the same Verify token.
  2. Subscribe to the messages field.

Sender Controls

  • An Owner number saved in Access & Trust is an expected identity for pairing. The declaration constrains the sender but never grants authority by itself.
  • Allowed senders admit direct conversations with restricted trust. They never make a sender the owner. Everyone else is ignored.
  • WhatsApp Cloud is direct-message only in Lenno. Use the separate WhatsApp Web adapter for group conversations; group-shaped IDs are rejected here.

Pairing The Owner

The webhook signature proves that Meta delivered an event; it does not prove that the sender is the agent owner. To establish owner authority:

  1. Optionally save the expected owner number in Access & Trust. The declaration constrains even a direct-message pairing attempt.
  2. Generate a code for this exact WhatsApp channel.
  3. From the owner’s number, send /pair <code> within 15 minutes. Use a direct conversation when no expected number is configured.

The code is single-use and cannot pair another WhatsApp channel. Pair only in a direct conversation; Cloud group-shaped messages fail closed. Until pairing succeeds, an allowed sender remains restricted and cannot command the agent.

Tips

  • Use a permanent system-user token, not a temporary one – temporary tokens expire and silently break delivery.
  • The app secret is required: without it inbound webhook signatures cannot be verified and messages are rejected.