"This authorization code has expired" after Coexistence signup

What code has expired?

When the business completes Embedded Signup, Meta returns the asset IDs and an exchangeable token code to the browser window that opened the popup. The platform then sends that code to its own server, which calls Meta's oauth access_token endpoint with its app ID and app secret to exchange it for a business token.

Meta's implementation guide is explicit about timing: the exchangeable token code has a time-to-live of 30 seconds, so the platform must be able to exchange it before it expires. An exchange attempted after that point is refused, and "This authorization code has expired" is how that refusal reads. The business did nothing wrong by finishing the popup slowly; the clock starts when the code is returned.

Why does it happen after the popup finishes late or twice?

Several situations can delay the exchange past that limit.

The browser tab was left in the background or the laptop slept as the flow finished, so the code reached the platform's server well after it was issued. The platform's server queued the exchange behind other work instead of doing it straight away. Or the person opened the flow twice, finished both, and the platform exchanged the code from the first window after the second one completed.

In testing there is a fourth: copying the code out of the browser console and exchanging it by hand with cURL or Postman. Meta's guide warns about exactly this and says to have the exchange request ready before starting.

How do you complete the connection?

Run the flow again from the start in a single window, and let it finish with the platform's page in the foreground. Each completion returns a new code, and a prompt exchange of that code is all the platform needs.

For a Coexistence number, do it promptly. Meta converts the WhatsApp Business account when the business completes the flow, and once the platform onboards the customer it has 24 hours to synchronise messaging history; after that, the business must be offboarded and complete the flow again.

On the platform side, the durable fix is to exchange the code on the server the moment it arrives, before any other onboarding step.

Common mistakes

• Retrying the token exchange with the same code. It expired after 30 seconds and will not come back.
• Running the signup in two windows at once. Only the code from the attempt being exchanged counts.
• Exchanging the code from the browser. Meta requires the exchange as a server-to-server request with the app secret.

Frequently asked questions

Keep reading