WhatsApp error 10: permission not granted or removed
Error code 10 means the app's token lacks a permission the endpoint needs, either because it was never granted or because it was removed. Meta's description is "Permission is either not granted or has been removed." Meta also lists two WhatsApp causes: an unallowlisted number on Flows with Endpoint, and not meeting an API's eligibility requirements.
Meta's code for "Permission is either not granted or has been removed."
The name the Graph API error handling guide gives code 10.
What a partner app needs for each permission it uses on client accounts.
What does WhatsApp error code 10 mean?
It means the token reached Meta and was recognised, but the permission the call requires is not on it.
Meta's Cloud API reference gives code 10 the details text "Permission is either not granted or has been removed." The Graph API error handling guide calls it API Permission Denied and says to handle the missing permission.
The word removed matters. A permission can be granted at setup and taken away later, for example when someone revokes the app's access in Business Settings, so an integration that worked for months can start returning 10 without any change to its own code.
What other causes does Meta list for error 10?
Two that are specific to WhatsApp, and both are easy to miss because they are not about scopes at all.
For WhatsApp Flows with Endpoint, Meta says to make sure the phone number used to set the business public key is allowlisted. A number outside the allowlist produces this code even when the token carries every permission.
Meta also says that an account which does not meet the eligibility requirements for the API it is calling receives this code. In that case no token change will help, because the gate is the account's eligibility rather than the credential.
How do you fix error 10?
Start with the access token debugger, which Meta names as the first check.
If the scopes list lacks the permission the endpoint needs, have the business grant it again. For a partner app, that also means confirming Advanced access for the permission, since Meta's permissions guide requires it for client accounts.
If the scopes look complete, move to the two WhatsApp causes. On a Flows call, check the allowlist for the number that set the public key. On anything else, read the eligibility requirements for the API you are calling and confirm the account meets them before changing any credential.
Common mistakes
- Assuming the integration broke because of a deploy. A permission removed in Business Settings produces this code with no code change at all.
- Rebuilding the token when the cause is eligibility. A credential cannot make an ineligible account eligible.
- Ignoring the Flows allowlist. On Flows with Endpoint, a number outside it returns 10 even with full scopes.
EasyCoexistence keeps watching each connected number after onboarding, so a connection that loses access shows up on the dashboard instead of surfacing first as failed sends.
Frequently asked questions
Is error 10 the same as error 131005?
They share the same description in Meta's reference. Code 10 is the Graph API code and 131005 sits in the WhatsApp range. Both are checked the same way.
Can error 10 appear on a number that worked yesterday?
Yes. Meta's description includes permissions that have been removed, so access granted earlier can be withdrawn later.
Does error 10 mean my token expired?
No. An expired token is code 190 or 0. Code 10 means the token is valid but lacks a permission.
How do I see what permissions were granted?
Call debug_token or open the access token debugger. The scopes property lists every permission on the token.
Keep reading
Ready to get started?
Set up WhatsApp Coexistence in minutes, not months. The app keeps working on the phone.
Start Free TrialVerified on