The Page token that dies when somebody leaves

A Page access token inherits the access of the person who granted it. When that person leaves the company and their Page role is removed, the token stops working - and the failure arrives as a permissions error that reads like a code bug.

What the error looks like

{
  "error": {
    "message": "(#200) Requires pages_messaging permission ...",
    "type": "OAuthException",
    "code": 200
  }
}

Code 200, code 3, or subcode 1349125. All of them read as "permission" and all of them mean the same operational thing: somebody has to reconnect. Software that retries these is wasting an afternoon.

Use a system user

A system user is an identity inside Business Manager that is not a person. It can be granted the Page and the WhatsApp Business Account, and tokens it issues do not depend on anybody's employment.

1. Create the system user in Business Manager.
2. Assign it the Page and the WABA, with the access the integration actually needs and no more.
3. Generate the token from the system user, not from your own account.
4. Store it where the company controls it, and record which assets it covers.

Page roles, briefly

• Two admins minimum, both employees, both with two-factor. One admin is a single point of failure with a notice period.
• Editors can message. Most people who answer DMs do not need admin.
• Remove access when people leave, and check afterwards that messaging still works - because that is exactly when it stops.

Why this hits Instagram hardest

Instagram business messaging runs through the linked Page, so losing Page access breaks Instagram even though nothing about the Instagram account changed. It is the most confusing version of this failure and the most common.