I'm implementing WhatsApp Embedded Signup (v23.0 JS SDK) with the official "WhatsApp embedded sign-up configuration with 60-day expiry token" template, and every attempt to launch FB.login() fails with:

"It looks like this app isn't available. This app needs at least one supported permission."

Steps to reproduce:

1. Create a Login Configuration via Facebook Login for Business → Configurations → Create from template → "WhatsApp embedded sign-up configuration with 60-day expiry token".
2. Confirm the resulting configuration has: Login variation = WhatsApp Embedded Signup, Access token = System-user (60-day expiry), Products = WhatsApp Cloud API, Assets = WhatsApp accounts, Permissions = whatsapp_business_management + whatsapp_business_messaging (both show "Ready for testing" status, not "Requires App Review").
3. Enable "Login with the JavaScript SDK", add the hosting domain to both "Allowed Domains for the JavaScript SDK" and "Valid OAuth Redirect URIs", and to the app's "App Domains" field.
4. Host a minimal page with:

FB.login(fbLoginCallback, { config_id: '<CONFIG_ID>', response_type: 'code', override_default_response_type: true, extras: { setup: {}, featureType: 'whatsapp_business_app_onboarding', sessionInfoVersion: '3' } });

1. Click the login button as the app's own Admin (System Administrator role on the connected, verified Business Portfolio).

Result: the OAuth dialog opens (confirmed via the exact URL: https://www.facebook.com/v23.0/dialog/oauth?client_id=<APP_ID>&redirect_uri=https://www.facebook.com/connect/login_success.html&response_type=code&config_id=<CONFIG_ID>) but immediately shows the "isn't available / needs at least one supported permission" error — never reaching the WABA picker or Coexistence step.

What I've ruled out: - Not a config data issue — verified via the read-only configuration detail view, which explicitly states "Login variation: WhatsApp Embedded Signup" and lists both whatsapp_business_management and whatsapp_business_messaging under Permissions. (Note: the separate Edit wizard's "Login variation" step showed only an unselected "General" radio option — inconsistent with the read-only view — so I relied on the read-only view as authoritative.) - Not an App Review / Standard-vs-Advanced-Access issue — both permissions show "Ready for testing" in Permissions and Features, and per the official docs, Standard Access is sufficient for the app's own admin during development ("Business apps are automatically approved for Standard Access... you do not need Advanced access or app review" as a Direct Developer accessing your own WABA). - Not an app-role issue — confirmed Administrator role on both apps for the account attempting login. - Not app-specific — reproduced identically on two separate, freshly-created apps under the same verified Business Portfolio, with the same template and the same setup steps. - Not a propagation-delay issue — retried multiple times across the session with identical results each time.

Questions: 1. What exactly does "at least one supported permission" mean in this context, given the config already includes two permissions both shown as "Ready for testing"? 2. Is there an additional, undocumented prerequisite (e.g., a specific Business Verification tier, a specific WhatsApp product setup step, a specific admin/Business Manager role) required before the WhatsApp Embedded Signup Login Configuration becomes usable in the OAuth dialog? 3. Are there known issues affecting the "WhatsApp embedded sign-up configuration with 60-day expiry token" template specifically?

App IDs for reference: 2693395424454058 (original app) and 1394780275426081 (fresh isolated repro app). Business Portfolio: verified.

Related thread: I found this possibly-related thread by Carlos Eduardo (https://developers.facebook.com/community/threads/2227779368076723/) describing an Embedded Signup failure ("the business cannot onboard clients at this time"), failing after Facebook auth but before asset selection, on a published app with Advanced Access already approved. My case differs — different error text, unpublished/Standard-Access apps — but may share a root cause in the same general area of the flow.