Meta API Error Codes Error 190 401 Unauthorized

WhatsApp Error 190: Access Token Expired or Invalidated — Fix (2026)

Error 190 means the bearer token in your Authorization header has expired, was invalidated due to a password change, or lacked required permission scopes.

Probable Causes

Using temporary 24-hour developer token instead of permanent System User token
User password was changed or 2FA was reset on the Admin Facebook account
The admin user who created the token was removed from Meta Business Manager

Step-by-Step Resolution

Recommended Fix Protocol:

Generate a permanent System User Token in Meta Business Manager: Go to Business Settings > Users > System Users > Add Admin System User > Generate Token > Select Never Expire > Grant whatsapp_business_messaging and whatsapp_business_management permissions.

Technical Example / Code Payload:

{ "error": { "message": "Error validating access token: Session has expired.", "type": "OAuthException", "code": 190, "error_subcode": 463 } }

Quick Answers

Frequently Asked Questions

Do System User tokens ever expire?+

Tokens generated under an Admin System User with Never selected will not expire unless manually revoked in Business Manager.

What permissions are mandatory for WhatsApp CRM?+

You must select whatsapp_business_messaging and whatsapp_business_management when generating the token.

Need Technical Help?

Resolve WhatsApp API Issues Fast with NY Digital

Our certified Meta API engineering team helps Indian enterprises diagnose webhook bugs, unblock banned numbers, and scale messaging limits safely.

Speak with Our Engineering Team