Skip to main content

​
Operator Onboarding

The operator app now has a dedicated Setup route at /setup for first-run configuration. Use it for first-run connection work. Use Settings at /settings for ongoing maintenance after the workspace is live.

​
What Setup Covers

The setup flow is designed to answer four questions:
  1. Is the workspace profile usable?
  2. Is a WhatsApp channel attached to the workspace?
  3. Are the provider secrets stored safely?
  4. Has the platform validated enough of the connection to begin controlled testing?

​
Expected Product Flow

  1. Sign in as the first workspace owner.
  2. Open Setup.
  3. Review workspace and channel identity.
  4. Enter the workspace-managed provider secrets.
  5. Validate the provider configuration.
  6. Open the inbox and run a controlled send test.

​
Secrets And Storage

The product distinguishes between two secret classes:
  • Platform/bootstrap secrets: deployment-owned values such as Supabase server credentials and base URLs. These remain runtime environment configuration.
  • Workspace-managed secrets: tenant-specific provider credentials entered through the product. These are written server-side and stored in Supabase Vault, with only masked status and validation metadata exposed in the UI.
The UI does not return decrypted secret values after write.

​
Readiness Checklist

The setup checklist is complete when:
  • workspace profile is set
  • channel identity is present
  • Meta access token is stored
  • webhook signing secret is stored
  • Meta verify token is stored
  • Meta validation no longer reports an invalid token

​
Operational Notes

  • Environment-backed provider secrets still work as a bootstrap fallback.
  • Once a workspace-managed Vault secret exists, it takes precedence over the environment fallback for that workspace.
  • Settings writes are owner/admin/developer restricted.

​
Onboarding an additional WhatsApp Business Account

The steps above describe the first WABA a workspace connects. A workspace is no longer limited to one WABA — the /welcome flow can also present a three-path chooser (bring your own token, onboard with us via Meta Embedded Signup, or migrate an existing WhatsApp account) when the Embedded Signup feature flag is enabled. Each additional WABA gets its own isolated access-token slot, so a second onboarded number never overwrites the first WABA’s credentials. See Meta Embedded Signup & Multi-WABA for the full flow, the feature-flag prerequisites, and how per-WABA token resolution works at send time.