Credential Setup Guide
This page shows exactly where to obtain the 4 keys/tokens needed for Yapper setup.
Quick Map
- WhatsApp Access Token: Meta Developer Portal -> App -> Use cases -> WhatsApp Dev Console -> API Setup -> Access Token
- WhatsApp Verify Token: You create this token yourself, then paste the same value in both Yapper and Meta webhook config
- WhatsApp App Secret: Meta Developer Portal -> App Settings -> Basic -> App Secret
- OpenRouter API Key: openrouter.ai/settings/keys
1) WhatsApp Access Token
Open your Meta app's WhatsApp Dev Console:
developers.facebook.com/apps/<YOUR_APP_ID>/use_cases/customize/wa-dev-console/
-> API Setup -> Access Token
- Open your Meta app and enter the WhatsApp Dev Console.
- Open API Setup.
- Copy the token shown in Access Token.
Important: The token in API Setup is usually temporary (commonly 24-hour lifetime). Use it for testing only.
For production, generate a permanent System User token in Meta Business
Manager with whatsapp_business_messaging permissions.
2) WhatsApp Verify Token
This is not issued by Meta. You choose it.
App-specific webhook config page:
developers.facebook.com/apps/<YOUR_APP_ID>/use_cases/customize/wa-settings/
- Generate a random token, for example:
openssl rand -hex 32
-
Save that value in Yapper as
whatsapp_verify_token. - In Meta webhook setup, paste the exact same value into Verify Token.
If even one character differs between your backend and Meta, webhook verification fails.
3) WhatsApp App Secret
- Go to developers.facebook.com.
- Click My Apps and select your app.
- In the left sidebar, go to App Settings -> Basic.
- Find App Secret and click Show.
- Re-enter your Facebook password if prompted.
-
Copy the revealed value and save it in Yapper as
whatsapp_app_secret.
4) OpenRouter API Key
- Open openrouter.ai/settings/keys.
- Sign in to your OpenRouter account.
- Click Create Key.
- Name the key (example:
yapper-prod). -
Copy the key immediately and save it in Yapper as
llm_api_key.
Common Setup Errors
- Using the temporary API Setup Access Token in production
- Verify token mismatch between Yapper and Meta
- Using a token from the wrong Meta app/business
- Forgetting to rotate/re-save keys after regeneration