About

Zappio is a multi-tenant business-messaging platform built on the official WhatsApp Cloud API. It gives small businesses an inbox to handle conversations, send approved-template broadcasts, automate replies with bots, capture forms via WhatsApp Flows, and integrate Shopify order lookup — all from a clean, multi-agent workspace.

What we use Meta APIs for

• whatsapp_business_messaging — sending and receiving messages on the numbers our customers connect. This is the core of the product: without it, the inbox does nothing.
• whatsapp_business_management — reading and submitting message templates, reading the WABA's phone numbers, subscribing the WABA to our webhook for inbound delivery.
• business_management — reading the operator's Meta Business identity during Embedded Signup so we can attach the right WABA and number to the customer's workspace.

How a customer onboards

1. The customer signs in and starts a new project in Zappio.
2. They click Continue with Meta, which opens Meta's official Embedded Signup popup (Facebook Login for Business).
3. They sign in to Facebook, pick or create a WhatsApp Business Account, add and verify their phone number, and grant Zappio the permissions above.
4. Meta returns a short-lived authorization code to the browser. Zappio's server exchanges it for a business access token, registers the number, subscribes the WABA to our webhook, and stores the token encrypted at rest.
5. The customer can immediately send and receive messages from the inbox.

Security

• WhatsApp access tokens are encrypted at rest (AES-256-GCM).
• The browser never receives a long-lived token — only the short-lived Embedded Signup code, which is exchanged server-side.
• Tokens are auto-refreshed via fb_exchange_token ahead of expiry.
• Inbound webhooks are verified with the X-Hub-Signature-256 header when an app secret is configured.

Contact

Operated by TABSYST ENTERPRISE SOLUTIONS LLP in Kerala, India. Support: [email protected].

See also: Privacy Policy · Terms of Service.