The WhatsApp Business Platform: numbers, templates, windows and limits

Whichever way you build on WhatsApp, the same set of platform rules applies. They are not optional, they are not abstracted away by any tool, and almost every implementation that behaves strangely is running into one of them without realising.

This is the reference for those mechanics: how the account structure works, what the customer service window governs, how templates get approved and categorised, how messaging limits are calculated and where they are set. Meta changes details on a quarterly cadence, so treat this as the shape rather than the last word, and check the documentation before anything that depends on an exact figure.

What we'll cover

• The account structure
• The number, and its one-way doors
• The customer service window
• Templates, and what they are for
• Building it with CodeWords
• Categories, which decide cost and scrutiny
• Messaging limits and how they scale
• Quality, and what damages it
• Webhooks and delivery
• Where implementations go wrong
• Making it survive
• Limits worth knowing about
• What to set up first
• Frequently asked questions

The account structure

Three layers, and confusing them causes most of the early problems.

The business portfolio is the top level. It holds billing, permissions, and increasingly the things that used to be per-number. It is the layer that should belong to your business rather than to an individual or an agency.

The WhatsApp Business Account sits under the portfolio and holds templates and configuration.

The business phone number is what customers message.

Two consequences worth knowing early. Verification status attaches to the portfolio and affects what the accounts under it can do, including how many templates they may hold. And several things that people assume are per-number are actually pooled at portfolio level, which matters if you run more than one.

The number, and its one-way doors

A few decisions here are awkward to reverse.

Registration requires a number you can answer, since verification arrives as a code. The consumer app and the platform are mutually exclusive on the same number: whichever one holds it has to release it, and nothing crosses over when it does.

Landline numbers qualify, because voice verification is supported. Display names are reviewed separately from the number itself.

The recommendation is a number with no history. Migrating one that hundreds of customers already have saved costs you their existing thread and gains you nothing, so take a new one and leave the old answering alongside it.

The customer service window

The single most important mechanic, and the one that shapes every design.

An inbound message opens 24 hours of free-form replying. After that elapses, every outbound message has to be a template Meta has already approved.

Three consequences.

Reactive support is straightforward. Inside the window there is effectively no constraint on what you write.

Proactive contact is a planning problem. The approval queue is not something urgency shortens, so the catalogue has to be built ahead of demand rather than in response to it.

Window state changes underneath you. Whether a given recipient is inside their window at the instant you transmit is a live value, and code that resolves it once at composition time will send the wrong thing or nothing at all. Resolve it at transmission.

Templates, and what they are for

A template is a pre-approved message structure with placeholders, submitted to Meta and reviewed before use.

Approval takes time and is sometimes refused, which is why templates are a lead-time item. Submit everything you might plausibly need early, including the ones you hope not to use.

Two practical points. Placeholders are for variable details and not for smuggling arbitrary content past review. And translated text differs in length, so a template that fits within limits in one language may not in another, which is worth checking before submission rather than after rejection.

A verified portfolio with an approved display name can hold substantially more templates than an unverified one, so verification is worth doing early if you expect to need many.

Building it with CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: which messages go out when, what the templates say, and what happens to replies.
3. Authorize the connections to your existing systems and your WhatsApp Business Platform account.
4. Describe the exceptions: a closed window, a customer who has opted out, a template rejection, a message that fails to deliver.
5. Watch the quality rating during the first fortnight, since the early sending pattern is what sets your trajectory.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Categories, which decide cost and scrutiny

Templates are categorised, and the category affects both price and how closely the content is reviewed.

Utility relates to an existing transaction or service: a confirmation, an update, a reminder about something the customer has with you.

Marketing promotes something, including offers and re-engagement.

Authentication carries one-time codes.

Filing a template under the wrong category is corrected by Meta rather than overlooked, and a pattern of it counts against the account. The honest test: an offer you have to argue is really a service notification is an offer.

Billing moved to a per-message basis in mid-2025, replacing the older conversation unit. Rates turn on the category and the recipient's market, and the volume thresholds that reduce them pool across the whole portfolio (pricing documentation).

Messaging limits and how they scale

A messaging limit is the number of unique customer phone numbers you can deliver to, outside a customer service window, within a moving 24-hour period. It is calculated and set at the business portfolio level and shared across every number in that portfolio (messaging limits).

New portfolios start at 250. Completing a scaling path raises it, after which it increases automatically as you meet the criteria, which combine sustained volume with template quality. One of the routes is delivering a set number of template messages to unique recipients over a moving 30-day period with good quality.

Two things follow. Limits apply to proactive contact and not to replies within the window, so a support-heavy bot is rarely constrained. And because limits are shared across the portfolio, a campaign from one number affects what another can do, which surprises businesses running separate brands under one portfolio.

Quality, and what damages it

Meta scores your templates and numbers on how recipients react, and the effects are real: a poor rating restricts sending and can pause templates.

What damages it is predictable. Messaging people who never opted in. Sending high volume from a new number too quickly. Ignoring people who ask you to stop. Sending marketing dressed as utility. Content that is technically permitted and unwanted.

What protects it is equally predictable. Start slowly, send things people expect, honour opt-outs immediately and across every automation, and watch the rating weekly rather than discovering a restriction mid-campaign.

Webhooks and delivery

For anyone building directly, three properties to design around.

Delivery is at-least-once. The same event can arrive twice, so anything that creates a record, takes a payment or books a slot needs deduplication. This is the single most common production bug in this area.

Order is not guaranteed. Two messages sent close together may arrive in either order.

Your endpoint must be available. Messages arrive when customers send them, and an endpoint that is down loses them or triggers retries you have to handle.

Also handle status callbacks properly. Sent, delivered and read are distinct, and treating sent as delivered produces confident statements to customers that are not true.

Where implementations go wrong

Five recurring problems, in roughly the order they appear.

The portfolio is in the wrong name. Set up under a personal account or an agency's, discovered when somebody leaves. Trivial to fix at the start and a negotiation later.

Templates submitted too late. The message you urgently need is the one awaiting review, and no amount of urgency shortens it.

Window state assumed rather than checked. A reply composed against a window that has closed either fails or sends something other than what was written.

Duplicate events acted on. At-least-once delivery quietly produces double bookings and double charges, and the cause is rarely traced back to the webhook.

Sending too much too early from a new number. Limits and quality both start conservative, and a large first campaign is the reliable way to restrict yourself in the first fortnight.

None of these are exotic. All five are avoidable by somebody who knows the rules exist, which is the reason to read the mechanics before designing rather than after something behaves oddly.

Making it survive

Keep the portfolio in the business's name, with at least two administrators.

Verify early if you will need many templates.

Check window state at send, not at compose.

Deduplicate incoming events, always.

Review pricing and limits each quarter, since changes land on quarter boundaries.

Limits worth knowing about

No group messaging. Every message goes to one recipient.

Unofficial tools breach the terms and risk the number.

Templates constrain proactive contact, and approval takes time.

Limits are shared across the portfolio, not per number.

The rules change, and two significant changes have landed since mid-2025.

What to set up first

The portfolio, in the business's name, with two administrators, verified, and a fresh number. Before templates, before webhooks, before any automation. It takes under an hour and it is the only part that is genuinely painful to change afterwards.

Two habits make the difference. Submit every template you might plausibly need early, because approval is a lead time and the message you need urgently is the one you have not submitted. And deduplicate incoming events from the first line of code, since at-least-once delivery quietly produces double bookings that nobody traces back to the webhook.

Frequently asked questions

What are the three layers of the account structure?

The business portfolio holding billing and permissions, the WhatsApp Business Account holding templates and configuration, and the business phone number customers message. The portfolio should belong to your business.

What is the customer service window?

When a customer messages you, a 24-hour window opens in which you can reply freely. Outside it, contact must use an approved template. Check the window state at send rather than at compose.

Can a number already on WhatsApp be used?

It must be removed from the consumer app first, and that account's history does not transfer. Landlines work, since verification can be completed by voice call.

What are message templates for?

Any message sent outside the customer service window. They are pre-approved structures with placeholders, approval takes time, and a verified portfolio with an approved display name can hold far more of them.

What are the template categories?

Utility for messages about an existing transaction or service, marketing for anything promotional, and authentication for one-time codes. Category affects price and review, and miscategorisation is corrected by Meta.

What is a messaging limit?

The number of unique customer numbers you can deliver to outside a service window in a moving 24-hour period. It is set at portfolio level and shared across every number in it.

How do limits increase?

New portfolios start at 250 and rise by completing a scaling path, then automatically as you meet criteria combining sustained volume with template quality.

What damages the quality rating?

Messaging people who never opted in, high volume too soon from a new number, ignoring opt-outs, and marketing sent as utility. A poor rating restricts sending and can pause templates.

What do I need to know about webhooks?

Delivery is at-least-once so events can repeat and need deduplication, order is not guaranteed, and your endpoint has to be available. Sent, delivered and read are distinct statuses.

How often do the rules change?

Frequently enough to check quarterly. Pricing changes land on quarter boundaries, and the charging model has changed twice since mid-2025.

Related reading

• Choosing how to build it
• Testing it before customers do
• Whether to build one at all