Real Client Case Study
A SaaS founder built an AI assistant that helps businesses handle customer messages on Instagram and WhatsApp — upload a product spreadsheet and the app automatically responds to customer DMs with pricing and recommendations. The product was fully built but completely blocked. Meta's API permissions weren't approved, so the core messaging features couldn't go live. He came to me after weeks of being stuck, unsure what Meta actually needed to see.
What Permissions Were Needed and Why
Meta's permission system has dependencies — you cannot apply for one permission alone. If supporting permissions are missing, Meta rejects the entire submission. Here are all 12 permissions we applied for:
instagram_business_basic
Base dependency for all Instagram Business API access
instagram_basic
Base Instagram permission, required dependency for several others
instagram_business_manage_messages
Core permission to send and receive Instagram DMs via API
instagram_manage_messages
Required alongside the business version for full messaging coverage
pages_read_user_content
Read content from Facebook Pages linked to the Instagram account
pages_read_engagement
Read engagement data on Page posts
pages_show_list
Retrieve the list of Pages a user manages
business_management
Access Meta Business Suite data
public_profile
Base permission required for user authentication
email
User login and account identification
whatsapp_business_messaging
Send and receive WhatsApp messages via Business API
whatsapp_business_management
Manage WhatsApp Business accounts and settings
The Complications We Had to Solve
Meta Business Verification
Before advanced permissions can be approved, the developer's Meta Business Manager must be verified with real business documents. This step alone took several weeks — multiple submission attempts failed before verification finally completed.
Working Demo is Mandatory
Meta's review team does not approve permissions based on descriptions alone. They need to see a fully working application that actually demonstrates each permission being used. A non-functional or incomplete app is an automatic rejection.
The Approach
Rather than risk rejection on the client's main production domain, we used a subdomain strategy:
1
A separate subdomain was pointed to our server
2
We configured a fully working demo environment showing every permission in actual use
3
All 12 permissions were submitted together in one submission with the complete dependency chain
4
Meta's review team verified the working app with zero interference to the client's live setup
5
After approval, the client moved the domain back to their own server — approved permissions stayed intact — tied to the app, not the server
The Result
12 out of 13 permissions approved
App successfully published on Meta
Instagram and WhatsApp messaging fully functional in production
instagram_manage_comments was not approved in the first submission. Already resubmitted with additional documentation — awaiting Meta's decision.
~15 days total timeline
Meta controls their review speed. Our job is to make sure the submission is complete and correct the first time — no unnecessary delays.
Common Reasons Meta Rejects App Submissions
Incomplete dependency permissions missing from the submission
App not verified under a verified Meta Business Manager
No working demo that shows the permissions actually being used
Insufficient explanation of how each permission is used in the app