WhatsApp error 190: Access token has expired

Code 190 means the access token on the request was once valid and is now expired or has been invalidated. It is the single most recognizable WhatsApp API failure because of its timing: integrations that were built against the temporary token shown in the App Dashboard work flawlessly for a day and then fail with 190 overnight. That dashboard token lives for 24 hours and was only ever intended for testing.

Expiry is not the only trigger. Meta also invalidates tokens when the user who generated them changes their password, when a System User is deleted, when an app secret is reset, or when a token is found in a public repository. All of these produce the same 190 with an OAuthException type and HTTP 401.

Everything else about your request can be correct. Fixing 190 is purely a credential operation; no payload change will help.

190 always appears synchronously - it is raised by Graph API authentication before the WhatsApp layer sees the request, so it never shows up in a statuses webhook. The error_subcode narrows the story: 463 and 467 mean the token expired or was revoked, 460 means the password changed, 458 means the app session is gone. The decisive distinction is token type. A user access token inherits a human's session and dies with it - password change, logout, security checkpoint - while a System User token exists independently of any person and can be issued with no expiry, which is why production integrations must run on one. The temporary token on the App Dashboard's API Setup page is a user token with a 24-hour fuse, and it is the single most common source of worked-yesterday-fails-today reports in WhatsApp error triage. If you connect through a BSP such as Twilio or 360dialog you normally authenticate with the provider's own API key and never handle a Meta token, so a 190 there points at the provider-side credential or your embedded signup grant rather than anything you generated.

{
  "error": {
    "message": "Error validating access token: Session has expired on Tuesday, 18-Aug-26 09:00:00 PDT.",
    "type": "OAuthException",
    "code": 190,
    "error_subcode": 463,
    "fbtrace_id": "AxYz123AbC"
  }
}

Make a permanent System User token the only kind your deployment accepts, and have a startup check refuse to boot if the token debugger reports an expiry date. Add secret scanning to your repository so a token can never be pushed, and rotate tokens on a schedule you control rather than on Meta's. A token the platform cannot authenticate at all returns code 0 instead, and a live token missing a scope returns code 10.