Meta Business Verification for WhatsApp API: Step-by-Step Guide

Meta Business Verification for WhatsApp API: Step-by-Step Guide

To complete Meta business verification for the WhatsApp API, you need a business portfolio controlled by administrators from your company, legal details (legal name, tax ID, address, phone number) that match everywhere, a website on your own domain, and a document that proves the company exists. You submit the verification in the portfolio settings, and Meta reviews what you sent. Most rejections come from mismatches between the document, the website and the account record, not from technical failures.

Key takeaways

• Business verification proves to Meta that your company exists and is who it says it is. It is an account-level step, separate from the technical integration of the agent.
• The biggest risk is inconsistency: legal name, address and phone number must match across the document, the website and the business portfolio.
• Your own domain, an email address on that domain and a website that clearly shows the company reduce rework.
• The portfolio should be administered by people inside the company, with two-factor authentication, not by an outside party with no formal tie to the business.
• Switch the agent on only after verification, phone number, display name and messaging policy are all resolved.

What is business verification and why does it come before the agent?

Business verification is the process in which Meta checks the legal details of an organization linked to a business portfolio. That portfolio is what many people used to call Business Manager, and Meta changes names and screens often. Treat this article as a preparation roadmap and check the current labels in Meta's official WhatsApp platform documentation.

In practical terms, verification is usually required to move beyond initial testing and run real WhatsApp operations: scaling conversation volume, raising messaging limits and keeping the account stable. The exact rules vary by case and change over time, so treat any timeline or limit as something to confirm with Meta, not as a promise.

The reason to do this before the agent is simple. If you build the support flow, the prompts and the integrations and only then discover that verification is stuck, the project stalls over something that has nothing to do with code. Verification has an unpredictable timeline and depends on third parties, so it belongs at the start of the schedule.

If you have not yet decided between the regular app and the API, read WhatsApp Business API vs App for an AI Agent: Which to Use first. Verification only matters on the API path.

What should you prepare before opening the form?

Preparation is the part that actually prevents rejection. Gather everything in a shared folder and check it item by item before you open Meta's screens.

Preparation checklist:

• Legal name exactly as it appears on the company registration record (in Brazil, the CNPJ card), with no abbreviations that differ from the official ones.
• Company tax ID (CNPJ) and an active registration status.
• Full business address, identical to the registration record or to the proof document you will submit.
• Business phone number that can be found in public sources or on the company website.
• A live corporate website on your own domain, showing the company name, what it does and how to contact it.
• A corporate email address on the same domain as the website, to receive codes and communications.
• A supporting document: generally one of the company registration record, the articles of incorporation or another registration document, or a utility bill (electricity, phone, internet) in the company's name, depending on the options Meta shows for your case.
• At least two people from the company as administrators of the business portfolio, with two-factor authentication turned on.
• A phone number dedicated to WhatsApp that can receive a verification SMS or call.
• A company payment method for conversation charges, where applicable.

Accepted document options depend on the country and the legal form of the company, and Meta can change them. Use the list above to organize your material and leave the final choice to the options that appear on screen.

Domain, website and email: where verification usually gets stuck

Three problems come up often when it comes to domain and online presence.

The first is a website that does not look like the company's. A one-screen page with no legal name, no description of the business and no contact details gives the reviewer little to work with. Put the legal name, tax ID and address in the footer, and keep a contact page and a privacy policy. This also helps with LGPD, because data subjects need to know who is processing their data.

The second is a domain the company does not control. If the site was registered in the name of an agency or a former employee, you may not be able to prove ownership. Check the domain registry to see who the registrant is and who has access to the DNS panel. Domain verification in the business portfolio usually asks for a DNS change (a TXT record) or a tag added to the site, and without access you are stuck.

The third is a generic email address. An address from a free provider does not tie the company to the domain. Create a mailbox such as contact@ or it@ on the company domain before you start.

One rule solves a lot: the company name on the website, in the document and in the portfolio must be recognizable as the same. A trade name can appear on the site, but the legal name must be visible somewhere for the person checking.

Step-by-step verification process

The sequence below is a work plan. Menu names may change, so follow the logic and confirm the screens.

• Step 1: Assign an owner for the process. One person at the company with decision-making power and access to the corporate email leads everything, with IT support for DNS.
• Step 2: Create or locate the company's business portfolio. Check whether someone created one in the past so you do not duplicate it. Review who the administrators are and remove access that no longer makes sense.
• Step 3: Turn on two-factor authentication for administrators and review permissions. Give third parties (agency, consultancy) partial, time-limited access, not full control.
• Step 4: Fill in the company details in the portfolio information, copying them from the registration record. Do not type them from memory.
• Step 5: Verify the domain in the brand safety settings, using the method the screen offers (DNS or file/tag).
• Step 6: Start business verification, choose the country and the matching company, confirm the details and upload the requested document, legible and in good quality.
• Step 7: Choose the confirmation method Meta offers (email on your domain, phone or another) and enter the code you receive.
• Step 8: Track the status. While you wait, move on to the phone number and display name setup, but do not promise the business a launch date for the agent.
• Step 9: After approval, record in an internal document who verified, when and with which document, to make renewals and audits easier.

While you wait, use the time to prepare your messaging policy. If the agent will start conversations, the material on approved templates and consent is in WhatsApp Outbound Messages: Templates, Opt-In and Best Practices.

What if Meta rejects the request or asks for more information?

A rejection is not the end of the process, but it calls for diagnosis, not an immediate resubmission. Sending the same material with the same problems only repeats the result.

A simple decision guide:

• If the message points to a name mismatch, compare the legal name on the document, in the portfolio and on the website, and fix whatever differs before trying again.
• If it points to the address or phone number, check that the proof you sent shows the same address you registered and that the phone number appears in a public channel of the company.
• If it points to the document, send another permitted type, complete and uncropped, in good resolution and with all relevant pages.
• If it points to the website, adjust the content so it identifies the company and confirm that the domain is verified and reachable.
• If the status does not change for a long time, use the Meta support channels listed in the portfolio and keep ticket numbers and screenshots.

Avoid creating a second portfolio to get around the problem. Duplicate accounts confuse the review and can bring additional restrictions. Fix the existing record.

Illustrative scenario: the distributor that found the problem late

Illustrative scenario: a regional building materials distributor wants a WhatsApp agent to check product availability and pass orders to a salesperson. The technical team builds the flow, the ERP queries and the tests over weeks of internal work. When it is time to go live, they find that the portfolio was created by a former agency, the domain is registered to a partner who has left, and the address on the website belongs to a branch.

None of this is an artificial intelligence problem. It is account administration. Fixing it means recovering access to the domain, replacing administrators, aligning the address and only then submitting verification. If the company had worked through the checklist before development began, the agent would have been ready to launch when approval arrived, and the wait would have run in parallel with the technical work.

How verification fits into the implementation method

In our method, verification fits into the stages like this:

• Map: identify the legal owner, who administers the portfolio, which number will be used and who approves message content.
• Limit: define who has access to the portfolio, which permissions third parties receive and which customer data the agent can see and record. This boundary also shapes the division of responsibilities described in Data Controller vs Processor in an AI Vendor Contract (LGPD).
• Pilot: start with one real flow, on a test number or with a restricted audience, with conversations logged and a success metric agreed beforehand.
• Transfer: hand the company the documentation for access, administrators, domain and renewals, so operations do not depend on whoever set it up.

For the full path from account to a running agent, How to Integrate AI into Your Company's WhatsApp (2026 Guide) complements this article. For the technical side of the Cloud API, the reference is Meta's official Cloud API documentation.

Before you switch the agent on: final check

Once verification is approved, a few items are still commonly forgotten. Check each one before opening the service to the public:

• The display name has been approved and is consistent with the brand.
• The number is registered on the API and is no longer active in the regular app, where that applies.
• The payment method is active and someone is responsible for monitoring charges.
• The required message templates are approved, and consent (opt-in) is recorded.
• Handoff to a human agent works, with hours and a responsible person defined.
• The privacy policy discloses the use of automated service and the handling of data, in line with LGPD and the guidance of Brazil's data protection authority (ANPD).
• There is a log of the agent's decisions and a plan to shut it down quickly if something goes beyond what is expected.

Frequently asked questions

Do I need business verification to start testing the API? Generally, no. Meta allows testing with initial settings and test numbers before verification. But real operations, with more volume and stability, tend to depend on it, so start the process early.

Can a sole proprietor (MEI in Brazil) verify the business with Meta? It depends on which documents Meta accepts for your case and on how consistent your data is. If the sole proprietor has an active tax ID, a website or page with name and contact details, and documents that match each other, there is something to present. Confirm the options available on the verification screen, because they can vary.

Is business verification the same as the green badge for an official account? No. Business verification confirms the organization's legal details in the business portfolio. The official account badge is a separate matter with its own criteria, and it is not a requirement for running an agent on WhatsApp.

Can I let a consultancy or agency handle everything? They can help with execution, but ownership of the portfolio and the domain should stay with your company. Give third parties limited permissions and review them periodically, so your operation does not depend on an account you do not control.

Sources

• Meta for Developers: documentação da plataforma WhatsApp
• Meta for Developers: WhatsApp Cloud API
• ANPD: Autoridade Nacional de Proteção de Dados