WhatsApp error 10: Permission Denied

Code 10 means the token you used does not carry a permission the endpoint requires, or that permission used to be present and has since been revoked. The platform authenticated you successfully, then refused the specific operation. It is the most common error for teams who generate a token in a hurry and tick the wrong boxes, and for teams whose business admin later edited System User roles.

The two permissions that matter for the Cloud API are whatsapp_business_messaging (sending and receiving messages, media, and registration) and whatsapp_business_management (templates, phone numbers, WABA settings). A token with only one of them will get code 10 on the other family of endpoints. Meta's documentation also notes a case specific to the business public key endpoint: the phone number setting the key must be allowlisted.

This is not a token expiry. The same token will work on other endpoints where its scopes suffice.

Code 10 is synchronous, arrives with HTTP 403, and never reaches the messaging queue. Keep the authorization family straight when triaging: 190 means the token is dead, code 0 means it could not be authenticated at all, code 10 means a valid token lacks a scope, and the 200-series usually means the underlying user lacks a role on the asset; 131005 is the same refusal issued by the WhatsApp layer. Integrations that go through a BSP rarely meet code 10, because the provider holds the Meta-side permissions - when it does appear in a partner setup, the usual cause is the client revoking the partner's access to the WABA in Business Settings.

{
  "error": {
    "message": "(#10) Application does not have permission for this action",
    "type": "OAuthException",
    "code": 10,
    "fbtrace_id": "AbCd10EfGh789Ij"
  }
}

Standardize on one token template per environment that always carries both WhatsApp scopes, and record which System User and asset assignments back each production token. Alert on code 10 separately from other errors because it almost always follows a human change in Business Manager, and the fastest fix is to find out who changed what.