Run a Typebot flow on WhatsApp with Coexistence

Which Typebot fields take values from the connected number?

Typebot's WhatsApp wizard, under the Share tab of a bot, asks for four things: an app secret, a System User Token, a WhatsApp Business Account ID and a Phone number ID.

Three of them come straight from the connection. The dashboard shows the WABA id, the phone number id and the access token for the number, and the get_api_credentials tool returns the same values if an assistant is fetching them for you. Paste them into the matching fields.

The app secret is the one to leave blank. Typebot uses it for one thing on incoming traffic: checking the X-Hub-Signature-256 header Meta adds to every delivery. For a number connected through a Tech Provider, Meta signs with the provider's app secret, which is never shared, so any value you type there makes Typebot reject every genuine message. With the field empty, Typebot skips that check and accepts the delivery.

Where do Typebot's callback URL and verify token go?

Into the number's webhook destination, not into a Meta app dashboard.

Typebot's wizard tells you to paste its Callback URL and Verify Token into the WhatsApp settings of your own Meta app. With Coexistence through EasyCoexistence there is no app of yours involved: Meta routes the number's events to whatever destination is set on the connection. So copy both values from Typebot's last step and set them as the destination, in the dashboard or with set_webhook_destination.

Meta then sends its verification GET to Typebot, Typebot answers with the challenge, and from that point every message to the number reaches the bot. Typebot's verify token is single use: it is deleted from Typebot's database the moment a verification succeeds. If you set the destination again later, generate a fresh token by running the wizard again first.

What does the bot do with the 24 hour window?

Typebot replies to people who wrote to it, which keeps almost every message inside the customer service window. Meta opens a 24 hour window each time a customer writes, and inside it any service message type can be sent without a template. A bot that only ever answers is therefore the easy case.

The edge is a flow that waits. A Wait block, or a session that resumes after the customer has gone quiet for more than a day, will try to send a free text message outside the window, and Meta refuses it with error 131047. Typebot's session expiration timeout, 4 hours by default and settable up to 48, decides when a returning customer starts a new chat, not whether Meta accepts the message.

Because this is Coexistence, the team still sees every conversation in the WhatsApp Business app and can step in from the phone whenever the bot should not answer.

Common mistakes

• Pasting a Meta app secret into Typebot. Deliveries are signed with the Tech Provider's secret, so Typebot rejects every message as an invalid signature.
• Reusing an old Typebot verify token. It is deleted after one successful verification, so setting the destination again needs a fresh one from the wizard.
• Sharing the callback URL. With the signature check off, knowing the URL is what lets a request in, so treat it like a password.

Frequently asked questions

Keep reading