WhatsApp error 10: permission denied — cause and fix

WhatsApp error 10 means a permission the call needs was never granted or has been removed. On the Cloud API, the most common case misleads everyone: creating an AUTHENTICATION (OTP) template for a business Meta has not verified returns "Application does not have permission for this action". The problem is the business, not the application.

What does error 10 mean?

Meta lists it among the authorization errors:

"Permission is either not granted or has been removed." — Meta, Cloud API error codes

Meta's suggested fix covers three leads: check in the access token debugger that the app was granted the permissions the endpoint requires; for WhatsApp Flows with an endpoint, check that the phone number used to set the business public key is allowlisted; and check the eligibility requirements of the API you are calling, because an account that is not eligible gets exactly this code. The general Graph documentation calls code 10 "API Permission Denied" (Meta, Graph API error handling).

When does error 10 happen?

The OTP template case

This is the one that costs hours. On the accounts connected to Genuka WA, we see that:

• creating an AUTHENTICATION template fails with "Application does not have permission for this action" when the business has not passed Meta business verification;
• MARKETING and UTILITY templates on the same account are created normally;
• the account's health status carries error 141010, "The Business has not passed business verification".

A developer reported the same response on Meta's forum, with error_subcode: 2388185 and the user message "This WhatsApp Business account does not have permission to create message template" (Meta developer forum). The message blames the application. No token or permission setting changes anything.

You cannot work around it with a utility template either: when an app offers users one-time passwords or verification codes over WhatsApp, Meta requires an authentication template (Meta, Authentication templates).

Where do you see it in Genuka WA?

Genuka WA puts code 10 in the config class: token, permission or registration, nothing a retry can fix.

{
  "error": "meta_rejected",
  "message": "Application does not have permission for this action",
  "meta": {
    "errorClass": "config",
    "retryable": false,
    "code": 10,
    "traceId": "AbC…"
  }
}

How do I fix error 10?

On an authentication template

On a missing permission

• If you own the token: open it in the access token debugger, check whatsapp_business_management and whatsapp_business_messaging, and regenerate it with both if one is missing (Meta, WhatsApp support).
• If you go through Genuka WA: you have no Meta token to fix. A code 10 outside an authentication template is Genuka's to handle: contact support with the x-request-id header and meta.traceId.

How do I prevent error 10?

• Get the business verified before planning WhatsApp OTPs. It is a Meta prerequisite, not a Genuka option.
• Test the authentication flow on a verified account before you announce the feature: an unverified test account will always fail.
• Keep both WhatsApp permissions on any token you generate yourself.

Related error codes

• 141010: the business has not passed Meta business verification.
• 200: the token has no access to the account, or a permission is missing (200 to 299).
• 3: capability or permission missing for this endpoint.
• 190: the token has expired.

FAQ

Why does Meta blame the application when my token is fine?

Because the message is generic. On an AUTHENTICATION template we see it when the business is not verified, while the token and its permissions are correct: marketing and utility templates on the same account go through.

Can I send OTP codes with a utility template in the meantime?

No. Meta requires an authentication template for one-time codes. Until verification is done, send your codes through another channel, SMS or email.

Should I regenerate my Genuka API key?

No. Your Genuka key plays no part in Meta permissions. A key problem produces a Genuka 401, never a code 10.

Does code 10 also block my sends?

Not in the OTP template case: only creating AUTHENTICATION templates is refused. Your approved marketing and utility templates keep going out.

Sources

• Meta — Error codes
• Meta — Graph API, Handling errors
• Meta — Authentication templates
• Meta — Health status
• Meta — WhatsApp Business Account API
• Meta — Messaging limits
• Meta — WhatsApp support, authentication and authorization errors
• Meta — Verify your business in Meta Business Suite
• Meta developer forum — error 10 on an authentication template