WhatsApp error 190: access token expired
Error 190 means the access token used for the request has expired or been invalidated. Every call fails identically, which makes it look like the number disappeared. It has not: the credential broke, and the number is usually fine.
- A credential problem, not a number problem
- Every call fails the same way
- A second token tells them apart
Nothing charged for 7 days. Cancel anytime.
Meta's code for an access token that has expired or been invalidated.
Meta's code for the same condition reported as an authentication failure.
Credentials EasyCoexistence holds per connection, so a rejection can be diagnosed.
Why does an expired token look like a lost number?
Because every request fails, and they all fail the same way.
Reading the number, checking its health, listing templates and sending a message all stop working at once. From the outside that is indistinguishable from the number having been removed from the account, and an integration with one credential has no way to tell the two apart. Plenty of people conclude they have been disconnected when nothing of the sort happened.
The difference matters because the responses are opposite. A broken credential is replaced. A removed number has to be reconnected, which needs the business owner and the phone.
How do you tell the difference?
By having a second credential that can read the same account.
EasyCoexistence holds the client's token and its own System User token against each connection. When one is rejected, the other reads the WhatsApp Business Account and settles which of the two actually broke. A rejected client token with a working second read means the credential expired and the number is healthy. Both failing means something happened to the number itself.
Without that second reader, the only way to distinguish them is to ask the business owner to check, which is exactly the kind of interruption monitoring is supposed to avoid.
How do tokens get invalidated?
Several ways, most of them not deliberate.
Tokens have lifetimes and expire on their own. A password change on the Meta account invalidates them. Someone removing an app's access in Business Settings does it, and so does Meta revoking a token it considers compromised. None of these produce a warning first, and none of them are visible from the WhatsApp Business app on the phone.
This is why token validity belongs in monitoring rather than in an error handler. By the time an error handler sees it, sends have already failed.
Common mistakes
- Reconnecting the number. If the token is the problem, reconnecting asks the business owner to do work that was never needed.
- Treating it as intermittent and retrying. An invalidated token does not recover on its own.
- Relying on one credential. With a single token there is no way to tell a credential failure from a lost number.
EasyCoexistence holds two tokens against each connection, so a rejected credential is diagnosed rather than guessed at, and it demotes the broken one rather than dropping the number.
Frequently asked questions
Does the number still work?
Usually yes. The WhatsApp Business app is unaffected and the number itself is intact. What stopped is API access.
Is error 0 the same thing?
Effectively. Meta reports this condition under both codes depending on the endpoint.
Will reconnecting fix it?
It would, but it is the heavy answer to a light problem, and it needs the business owner and the phone for something a new credential solves.
Can tokens be made not to expire?
System User tokens can be long lived, which is part of why holding a second one is useful.
Keep reading
Ready to get started?
Set up WhatsApp Coexistence in minutes, not months. The app keeps working on the phone.
Start Free TrialNothing charged for 7 days. Cancel anytime.Verified on