Skip to main content
When you create a template in the AUTHENTICATION category (OTP, the “copy code” button) in WhatsApp Manager or through the Graph API, Meta may reject it with a generic, misleading error: “This WhatsApp Business account doesn’t have permission to create a message template”. In the API, the same error appears as “Application does not have permission for this action” with code: 10 and error_subcode: 2388185. The message suggests a problem with your account or with the template content, but it is almost never either one. The AUTHENTICATION category has an eligibility requirement of its own that UTILITY and MARKETING do not. This guide shows how to confirm the diagnosis and how to unlock the category.

​
What is the exact error?

The same error appears in two forms, depending on where you try to create the template. In WhatsApp Manager (UI):
Can’t create message template This WhatsApp Business account doesn’t have permission to create a message template.
In the Graph API (POST /{WABA_ID}/message_templates with category: "AUTHENTICATION"):
The UI simply re-displays that API error. The is_transient: false confirms that repeating the call will not help, and the fbtrace_id is the identifier Meta asks for when you open a support ticket.
Search terms: whatsapp authentication template not allowed, code 10 authentication template, error_subcode 2388185, can create utility but not authentication template whatsapp. It is the same problem described here.

​
Why does this happen?

Because the AUTHENTICATION category is restricted and has a separate eligibility gate. On top of what UTILITY and MARKETING already require, an authentication template is only unlocked when the account meets two requirements:
  1. Business verification through one of the official scaling paths (Meta’s “scaling paths”): direct Business Verification, partner-led verification through a Meta partner, or the Quality Messaging program.
  2. A minimum messaging volume/tier. Accounts in the starting tier cannot send authentication messages. Meta cites, as a reference, something around 2,000 messages delivered to unique users in 30 days (outside the 24h window, with good-quality templates).
There is no “enable authentication” button and no terms opt-in. The path is to verify the business and scale the tier. Since late 2025, Meta started blocking at template creation, instead of blocking only at send time. It is worth reinforcing what is not the cause:
  • It is not the template content. The same text, body, and button in another category passes; only AUTHENTICATION is rejected.
  • It is not a bug or a state of your specific account. The error reproduces across different WABA accounts, always only in the AUTHENTICATION category.
  • It is not a country restriction. The gate applies to any country; the authentication_international you see in some places is a pricing band, not a block.
The signal that closes the diagnosis is simple: UTILITY and MARKETING templates are created normally on the same account, and only the AUTHENTICATION one fails.

​
How to diagnose it?

The most direct way to isolate the gate is to create the same template in two categories and compare the response. If category: "UTILITY" passes and category: "AUTHENTICATION" returns code: 10 / error_subcode: 2388185, the problem is the category, not the content or the account.
The commands below talk directly to Meta’s Graph API and require a WABA access token. If you integrate through Zapster, on most accounts that token stays on our side (you use the Zapster API without handling the WABA token), so you probably will not be able to run these curl calls yourself. In that case, contact support and we will run the eligibility check for you. The examples that follow are for those who have direct access to the token.
This POST actually creates the template if the account has permission. Use it only for occasional manual diagnosis and delete the test template afterward. For a side-effect-free check, prefer the read-only signals described further below.
Switch category to "UTILITY" (with a simple body, no OTP button) and run it again. If UTILITY creates and AUTHENTICATION returns 2388185, the gate is confirmed.

​
How to check eligibility without creating anything?

No endpoint returns a definitive boolean for “can create authentication”, but there are read-only signals that work as a strong proxy:
  • Messaging tier (the cleanest signal). It is the same ladder Meta’s UI shows: 250 → 2,000 → 10,000 → 100,000 → unlimited. Tier 250 (starting) usually means authentication is blocked; from 2,000 up, the account is very likely eligible. There is no “1,000” tier (that number, common on partner blogs, is outdated).
  • health_status. GET /{PHONE_NUMBER_ID}?fields=health_status returns can_send_message per entity (PHONE_NUMBER, WABA, BUSINESS, APP) as AVAILABLE, LIMITED, or BLOCKED. A BUSINESS in LIMITED or BLOCKED usually indicates pending business verification.
  • Existing authentication templates. GET /{WABA_ID}/message_templates?category=AUTHENTICATION&fields=name,status. If any already exist, the account can create them. An empty list does not prove the opposite, so it only counts as a signal when there is a result.

​
How to fix it?

The path is to unlock the AUTHENTICATION category by meeting Meta’s official requirements. There is no configuration shortcut.
  1. Complete business verification through one of the three scaling paths: direct Business Verification, partner-led verification, or the Quality Messaging program. Without business verification, authentication stays blocked.
  2. Raise the messaging tier. The real gate is volume. While the account is in the starting tier (250), the category tends to stay blocked. Meta’s reference is around 2,000 messages delivered to unique users in 30 days, with good quality and outside the 24h window.
  3. Wait for the automatic release. When the account becomes eligible, the category usually unlocks in about 6 hours, with no manual action.
Deadlines and limits are set by Meta and may change. This guide describes observed behavior, not a guarantee from Meta.
If you have already completed business verification, are above the starting tier, and the error persists, then it is worth opening a ticket with Meta support. Include the error_subcode: 2388185 and the fbtrace_id from the API response, which is what speeds up their analysis. While the AUTHENTICATION category is not unlocked, a common stopgap is to send the OTP through another channel (SMS or email) and migrate to the authentication template once the account becomes eligible.

​
What does NOT fix the error?

Two attempts seem obvious and do not work:
  • Editing the template content. Because the block is by category, not by content, changing the text, body, or button does not change the result. The 2388185 error persists.
  • Delivering the OTP as a UTILITY template with a copy-code button. It is forbidden and tends to be rejected. The OTP button (copy-code / one-tap) is exclusive to AUTHENTICATION. The COPY_CODE button that exists in UTILITY and MARKETING is the coupon one (copy a discount code), not an OTP, and Meta rejects the combination with code: 100 / error_subcode: 2388180. Meta’s own categorization documentation is explicit: “Only authentication templates can be used to send a one-time passcode for identity verification. Marketing and utility templates cannot be used for this purpose.”
Even putting the code inline in the body, without a button, Meta’s content classifier recognizes the OTP pattern and marks the template as REJECTED. No text tweak gets around this. The only definitive path is to enable the AUTHENTICATION category.

​
How does Zapster help?

Zapster translates this opaque Meta error. In the template management screen, code: 10 / error_subcode: 2388185 becomes a clear message: it explains that authentication templates require completed business verification and a minimum message volume, and that UTILITY and MARKETING do not have that requirement. You understand the real reason without decoding the raw API response. Unlocking the category depends entirely on Meta (business verification and tier), so neither Zapster nor any other platform can guarantee approval or a timeline. What we do is make the diagnosis clear and support you through the process, including checking your account eligibility when you do not have direct access to the WABA token. If you are stuck on this error, contact support.

​
Frequently asked questions

Because only the AUTHENTICATION category has its own eligibility gate (business verification and messaging tier). UTILITY and MARKETING do not have that requirement, so they create normally on the same account. It is the classic signal that the block is by category, not by content or account.
It is the Graph API’s specific code for “the account does not have permission to create an authentication template”. It comes with code: 10 and type: OAuthException. In the UI, the same error appears as “This WhatsApp Business account doesn’t have permission to create a message template”.
No. The AUTHENTICATION category gate applies to any country. The authentication_international you see in some panels is a pricing band, not a creation block.
No. The block is by category, not by content. Changing the text, body, or button keeps the same error_subcode: 2388185.
No. The OTP button is exclusive to AUTHENTICATION, and Meta’s documentation forbids using utility or marketing templates to send a verification code. Even with the code inline in the body, the template ends up rejected. The only path is to enable the AUTHENTICATION category.
When the account completes business verification and raises the tier, the category usually unlocks in about 6 hours, automatically. Deadlines are set by Meta and may change.
Check the messaging tier (250 → 2,000 → 10,000 → 100,000 → unlimited): in the starting tier, authentication tends to stay blocked. If verification is complete and the tier has already risen, open a ticket with Meta support providing the error_subcode: 2388185 and the fbtrace_id from the response.

​
Meta’s official sources

​
Next steps