A SaaS founder built an AI assistant that helps businesses handle customer messages on Instagram and WhatsApp — upload a product spreadsheet and the app automatically responds to customer DMs with pricing and recommendations. The product was fully built but completely blocked. Meta’s API permissions weren’t approved, so the core messaging features couldn’t go live. He came to me after weeks of being stuck, unsure what Meta actually needed to see.
What Permissions Were Needed and Why
Meta’s permission system has dependencies — you cannot apply for one permission alone. If supporting permissions are missing, Meta rejects the entire submission. Here are all 12 permissions we applied for:instagram_business_basicBase dependency for all Instagram Business API accessinstagram_basicBase Instagram permission, required dependency for several othersinstagram_business_manage_messagesCore permission to send and receive Instagram DMs via APIinstagram_manage_messagesRequired alongside the business version for full messaging coveragepages_read_user_contentRead content from Facebook Pages linked to the Instagram accountpages_read_engagementRead engagement data on Page postspages_show_listRetrieve the list of Pages a user managesbusiness_managementAccess Meta Business Suite datapublic_profileBase permission required for user authenticationemailUser login and account identificationwhatsapp_business_messagingSend and receive WhatsApp messages via Business APIwhatsapp_business_managementManage WhatsApp Business accounts and settingsThe Complications We Had to Solve
🔒 Meta Business Verification
Before advanced permissions can be approved, the developer’s Meta Business Manager must be verified with real business documents. This step alone took several weeks — multiple submission attempts failed before verification finally completed.🎥 Working Demo is Mandatory
Meta’s review team does not approve permissions based on descriptions alone. They need to see a fully working application that actually demonstrates each permission being used. A non-functional or incomplete app is an automatic rejection.The Approach
Rather than risk rejection on the client’s main production domain, we used a subdomain strategy:- A separate subdomain was pointed to our server
- We configured a fully working demo environment showing every permission in actual use
- All 12 permissions were submitted together in one submission with the complete dependency chain
- Meta’s review team verified the working app with zero interference to the client’s live production setup
- After approval, the client moved the domain back to their own server — approved permissions stayed intact (they are tied to the app, not the server or IP address)
The Result
✅12 out of 13 permissions approved
✅App successfully published on Meta
✅Instagram and WhatsApp messaging fully functional in production
⚠️ instagram_manage_comments was not approved in the first submission. Already resubmitted with additional documentation — awaiting Meta’s decision.
⏱ ~15 days total timeline
Meta controls their review speed. Our job is to make sure the submission is complete and correct the first time — no unnecessary delays.Common Reasons Meta Rejects App Submissions
- Incomplete dependency permissions missing from the submission
- App not verified under a verified Meta Business Manager
- No working demo that shows the permissions actually being used
- Insufficient explanation of how each permission is used in the app