For MuseRelay to read and reply to messages on your WhatsApp, Instagram or Messenger, Meta gives us access (a token) to your account. This guide explains the two ways to get that access, how long it lasts, who renews it and what happens —and what we tell you— if it stops working.
Two ways to connect
Your own credentials (BYOK)
You use your own app in Meta for Developers and paste its IDs and token into MuseRelay.
- Works today, on every plan that includes the channel.
- The access is yours: you control and revoke it from your app.
- Takes a few minutes in Meta for Developers (we guide you step by step) and your app’s App Secret, which is required.
- To serve any customer, your app must be live and, for Instagram and Messenger, have its permissions approved by Meta.
Guided connection
You click a button, log in with Meta, pick the account or page and accept. No apps or tokens.
- Instagram: “Connect with Instagram”.
- Messenger: “Connect with Facebook” and pick the page.
- WhatsApp: “Guided connection (1 click)”.
- If it ever stops working, you fix it with the Reconnect button.
We’re rolling out the guided connection progressively, so less technical customers can connect their channels without going through Meta for Developers. It doesn’t replace your own credentials: you’ll be able to choose, channel by channel, whichever you prefer. Until it’s available in your account, connect with your own credentials.
Pros and cons of each mode
| Your own credentials (BYOK) | Guided connection | |
|---|---|---|
| Setup | Create an app in Meta for Developers, generate the token, copy the App Secret and IDs and set up the webhook. 15 to 30 minutes the first time. | One button, log in and accept. A couple of minutes. |
| Who owns the app | You. You see its permissions, logs and settings in your Meta dashboard. | MuseRelay. You authorise our app to use your account. |
| Access control | Full: regenerate the token, change the App Secret or delete the app whenever you want, without going through us. | You revoke it from your Instagram or Facebook settings, or by disconnecting the channel. |
| Dependency | Your channels run on your own app, without depending on MuseRelay’s. | Your channels run through MuseRelay’s app. |
| Meta review | WhatsApp: not needed. Instagram and Messenger: to talk to anyone, your app needs its permissions approved by Meta (app review and business verification). | We do it, once for all customers. |
| Maintenance | Yours. Some tokens renew automatically (see below); if you change the App Secret or token at Meta, update it in the channel. | None, except reconnecting if Meta cuts access. |
| Message security | Every incoming message is checked against Meta’s signature using your App Secret. | The same, with MuseRelay’s app secret. |
Why choose your own credentials?
- More control. The connection lives in your Meta account: you decide its permissions, revoke it instantly and can switch provider without asking anyone.
- More privacy and traceability. No third-party app has permission over your account: you give access to your own app, and Meta shows you in your dashboard what it does with it.
- Independence. Your channels run on your own Meta app, without depending on MuseRelay’s, and you can connect them today.
- Ideal for agencies and companies with a technical team, or with internal policies that require integrations to use their own apps.
If you don’t have these needs, the guided connection will be the easiest option once it’s available.
Who pays Meta?
WhatsApp: Meta charges conversations directly to your WhatsApp Business account, using the payment method you add at Meta, in both modes. MuseRelay doesn’t act as an intermediary in that payment. Instagram and Messenger: Meta doesn’t charge for messages.
The App Secret: required with your own credentials
Meta signs every message it sends us with the app’s App Secret. We use it to check that the message really comes from Meta and not from someone who has found the webhook address. That’s why, when connecting with your own credentials, it’s required: without it, or if it doesn’t match, we reject the messages.
Only incoming messages, the ones Meta sends us when a customer writes to you. Without this check, someone who found the webhook address could pretend to be Meta and slip fake messages into your inbox on behalf of a customer: your AI assistant would answer them (spending credits) and they could end up as made-up bookings, tickets or leads.
The messages you send don’t change: they go straight to Meta with your token.
| Channel | Where to find the App Secret |
|---|---|
| Meta for Developers → your app → App settings → Basic → “App secret”. | |
Instagram (IGAA… token) | Meta for Developers → your app → Instagram → API setup with Instagram login → “Instagram app secret”. |
Instagram (EAA… token) | App settings → Basic → “App secret”. |
| Messenger | App settings → Basic → “App secret”. |
Paste it into the channel settings (for Instagram and Messenger, under “App Secret and advanced settings”). It’s stored encrypted and never shown again; to change it, type the new one, and if you leave the field empty the saved one is kept.
- App Secret missing: the channel page shows “App Secret missing: this channel isn’t receiving messages”, with a button to add it.
- Doesn’t match: “Meta is sending messages, but the signature doesn’t match”, with the time of the last rejected message. It’s usually another app’s secret (on Instagram with an
IGAA…token, remember it’s the Instagram app’s one).
As soon as you save the right one, new messages come in again and the alert disappears with the first correctly signed message.
If you use your own credentials: checklist
- Your Meta app has the channel’s product (WhatsApp, Instagram or Messenger) and is Live.
- You’ve pasted the token, the IDs it asks for and the App Secret into the channel.
- In your app you’ve set up the webhook with the URL and verify token the channel gives you, and subscribed to the events it lists.
- WhatsApp: the token is a System User token set to expire “Never”, and your account has a payment method at Meta.
- Instagram and Messenger: to serve anyone, your app has its messaging permissions approved by Meta; without them it only works with accounts that have a role in your app.
- You’ve sent a test message and it shows up in the inbox.
How long access lasts and who renews it
| Channel | Your own credentials (BYOK) | Guided connection |
|---|---|---|
| With a System User token set to expire “Never”, it doesn’t expire (recommended). A normal user token expires within hours. | Created when you connect. MuseRelay checks every day that it’s still valid. | |
IGAA… token: lasts 60 days and MuseRelay renews it automatically. EAA… page token: renewed automatically if you save the App ID, App Secret and a user token in the advanced settings; otherwise you renew it. | 60-day token that MuseRelay renews automatically. | |
| Messenger | EAA… page token: renewed automatically if you save the App ID, App Secret and a user token in the advanced settings; otherwise you renew it. | Page token with no expiry. |
How automatic renewal works: every night MuseRelay checks the tokens that expire in 10 days or less and asks Meta for a new one. You don’t need to do anything, and if it fails one night it tries again on the following nights.
Meta invalidates access, renewed or not, when:
- you remove the app’s permission in your Instagram or Facebook settings, or change the account password;
- the person who connected stops being an admin of the page or account;
- Meta revokes it for security reasons, or you delete your app (BYOK);
- the channel is deactivated in MuseRelay: deactivated channels aren’t renewed, and after 60 days the Instagram token expires.
How we monitor your channels
Every 6 hours MuseRelay checks with Meta that each WhatsApp, Instagram and Messenger channel still has working access (except deactivated ones).
- A single failure changes nothing: the channel turns to Error when two checks in a row fail for the same reason.
- Network problems or brief Meta outages do not mark the channel as failed.
- If we know the token’s expiry date, we watch it too so we can warn you in advance.
Which alerts you get
| Alert | When | Where |
|---|---|---|
| Channel error | When the failure is confirmed. If it isn’t fixed, it’s repeated at most every 3 days. | |
| Token expiring soon | 30, 15 and 7 days before expiry, and when it expires. For tokens we renew automatically (IGAA…) we only alert at 7 days, because it means renewal has been failing for several nights. | |
| Channels that need your action | When you open the dashboard while any channel has an error or an expired or soon-to-expire token. You can choose “Don’t show again”. | Dashboard |
| Channel status | Always: a warning next to the channel in the menu and “Disconnected” status on its page, with the button to fix it. | Dashboard |
Emails go to the workspace owner and its active admins, in their language, and include what Meta says and the steps to fix it based on how you connected the channel.
What happens while a channel is down
- Conversations stay in the inbox. You can read the channel’s whole history; nothing is deleted.
- You can’t reply on that channel. Neither your AI assistant nor your team can send messages through it until it’s fixed; the inbox shows this.
- New messages usually keep arriving. If the token has only expired, Meta normally keeps sending us your customers’ messages: they’re saved in the inbox and the bell alerts you, but you can’t reply. If access has been revoked (for example, you removed the app’s permission), Meta may stop sending them. That’s why it’s best to fix it as soon as possible.
- Your other channels are unaffected. The problem only affects that channel.
How to fix it
If you connected with the guided connection
- Open the channel in MuseRelay.
- Click Reconnect account (Instagram) or Reconnect page (Messenger).
- Log in with the channel’s own account (for Messenger, a user who manages the page) and accept the permissions.
- Done: the channel works again straight away.
Meta uses the session open in your browser. If another account shows up, log out in that window (or use a private window) and log in with the right one. MuseRelay won’t save an account that’s already in another channel or, on Instagram, an account other than the channel’s own: it tells you and changes nothing.
If you connected with your own credentials
| Channel | What to do |
|---|---|
| In Meta Business Manager → Business settings → System users, generate a new token for the channel’s system user (expiry “Never”). | |
In your Meta for Developers app → Instagram → API setup, generate a new token (IGAA…) for the account. | |
| Messenger | In your app → Messenger → API setup, generate a new token (EAA…) for the page. Also save the App ID, App Secret and a user token so it renews automatically. |
Then paste the token into the channel settings and save: MuseRelay checks the connection right away and, if all is well, the channel returns to Active. You can also click Revalidate connection at any time.
Always fix the existing channel; don’t create a new one. That way you keep every conversation, contact and setting. Once it recovers, alerts reset and you’ll get them again if it ever fails in the future.
FAQ
Do I have to renew anything every 60 days?
No, if your token is one we renew automatically (Instagram IGAA…, or pages with App ID, App Secret and user token saved). You’ll only need to step in if Meta cuts access for one of the reasons above, and we’ll tell you.
I got “Channel error” but the channel works
Click Revalidate connection on the channel. If the connection is fine, the channel returns to Active and the alerts reset.
I reset the App Secret at Meta and messages stopped coming in
When you reset the App Secret at Meta, the old one stops working. Paste the new one into the channel settings and messages come in again.
Can I start with my own credentials and switch to the guided connection later?
We’ll explain how once the guided connection is available in your account. Meanwhile, connect with your own credentials with peace of mind: what matters is not deleting the channel, so you keep its history.
Who receives the emails?
The workspace owner and its active admins. Agents don’t receive them.