At a glance
- Prepare your Meta app and copy your MPS Solution ID.
- Launch Embedded Signup so the customer can authorize your app.
- Complete onboarding on your backend, including registration and webhook setup.
- Confirm Kapso detected and funded the account before paid traffic.
- Start messaging and monitor usage in Kapso.
@kapso/sdk, a Kapso setup link, or Kapso’s onboarding endpoints.
Prepare your Meta app
- Activate a Multi-partner Solution with Messages processed by: Your infrastructure and App with messaging permission: Your Meta app.
- Copy the Meta solution ID from Tenants > Multi-partner solution. This is not the Meta App ID or a Kapso UUID.
- Create a Facebook Login for Business configuration for your Tech Provider app, using WhatsApp Embedded Signup v4 and the products you need.
- Add your HTTPS domain and OAuth redirect URIs in Meta’s login settings. Kapso setup-link
allowed_originsdoes not apply to this path. - Configure your webhook endpoint and subscribe your Meta app to
account_updateandmessages.
Launch Embedded Signup
If you already have Embedded Signup, addextras.setup.solutionID to your existing FB.login options. Keep the SDK initialization and flow options appropriate for your configuration.
For a new v4 integration, this example initializes Meta once and enables the button only after FB.init completes:
solutionID is case-sensitive and belongs inside extras.setup, not at the top level. Keep it as a string. The Solution ID links the customer’s authorization to both partners. See Meta’s Multi-partner Solution instructions.
If you offer multiple solutions, select the correct App ID, configuration ID, and Solution ID for the customer before enabling the button. Store that expected context with the onboarding attempt on your backend.
Complete onboarding on your backend
The example’s/api/whatsapp/onboarding/complete is an endpoint in your application. Protect it with your normal authentication and CSRF controls; adapt the request headers to your framework. Bind the attempt to the signed-in customer.
- Exchange
codethrough Meta’sGET /oauth/access_token, using your App ID and app secret. Store the returned business token securely on your server; do not log it or return it to the browser. - Resolve the authorized WABA and phone number using that token. If multiple assets are available, confirm the customer’s selection rather than choosing the first result. You can also collect IDs through Meta’s
WA_EMBEDDED_SIGNUPbrowser event: validate the event origin and verify asset access server-side. Browser-supplied IDs are not proof of ownership or funding. - Subscribe your app to the customer’s WABA with
POST /{WABA_ID}/subscribed_appsso your backend receives message webhooks. - Register the phone number with
POST /{PHONE_NUMBER_ID}/registerwhen required by the selected flow. The example targets the standard Cloud API flow; follow Meta’s separate requirements for coexistence, migrations, or WABA-only signup. - Persist the connection in your system. Return success only after the required backend setup completes.
Confirm managed funding in Kapso
Meta notifies Kapso throughaccount_update when the customer joins the solution. Kapso detects the WABA and attempts to fund it automatically, subject to eligibility and your project’s prepaid balance. You do not need to send Kapso the customer’s authorization code or business token.
Open Tenants > Multi-partner solution, find the WABA, and confirm that managed funding is verified before sending paid messages. A successful signup callback or a detected WABA alone does not confirm funding. If the account shows Needs attention, resolve the displayed issue first.
External onboarding does not create a Kapso WhatsApp configuration or emit the hosted path’s whatsapp.phone_number.created event. Your own backend tracks connection completion; the Kapso account table tracks funding and aggregate usage.
If the WABA does not appear, check that signup used the exact active Solution ID and the correct Meta app. If those match, contact Kapso with the Solution ID, WABA ID, and signup time. Do not send secrets or access tokens.

