How to get a Facebook access token

If we are building your dashboard and one of your data sources is your Facebook Page, we will ask you for a "Facebook Page access token". This one is a bit more involved than the key for a service like Matomo or MailerLite, because Meta (Facebook's parent company) uses a layered system. Take it slowly, follow each step in order, and you will get there. No technical knowledge is assumed.

What is an access token, and why is Facebook's different?

Most services give you one simple API key. Meta's system is layered, and it helps to know the layers before you start:

• User access token: a token that acts as you, granted through a login approval. Short-lived.
• Long-lived user access token: a user token exchanged to last about 60 days.
• Page access token: a token that acts on a specific Facebook Page. When generated from a long-lived user token, it has no expiry date. This is the one our dashboard needs.

Three important things about any of these tokens:

• They are made in Meta's developer tools, not in normal Facebook settings. That is why this guide has more steps than the others.
• They are secret. A Page token in the wrong hands means someone can read and even post to your Page. Treat it like your banking password.
• They can be invalidated and replaced. You can remove an app's access from your Facebook settings at any time, and generate a fresh token, without changing your Facebook password.

What you need before you start

• Your normal Facebook login, with admin rights on the Page you want to connect. If someone else manages your Page, either get admin access or have that person do these steps.
• Access to developers.facebook.com (free; you sign in with your normal Facebook account).
• About 15 minutes. There is nothing difficult, just several screens.

Step A: Create your Meta developer app

Tokens are always issued through a Meta app, so first we create a free one.

A1. Create a developer account

Go to developers.facebook.com in your browser (you stay logged in with your normal Facebook account) and register as a developer if you have not before. It is free and takes a minute; you may be asked to verify with a phone number.

A2. Create the app

While logged in, use the Get Started / Create App flow: give the app any name (e.g. Xenium Designs Dashboard), enter a contact email, and choose a use case such as Business (or "Business" type if shown as an option). Confirm, and you land on the app's dashboard. If Facebook asks you to pick products to add, choose Graph API Explorer or Facebook Login if asked.

A3. Note your App ID and App Secret

On the app's dashboard, open Settings, Basic in the left menu. You will see an App ID (a number) and an App Secret (a hidden string; click Show to reveal it, Facebook may ask you to re-enter your password). Copy both somewhere safe, we will need them shortly, and keep the App Secret private, it is the master key to your app.

Step B: Get a short-lived user access token

B1. Open the Graph API Explorer

Go to developers.facebook.com/tools/explorer. Meta may ask you to pick your new app from a dropdown, if so, choose Xenium Designs Dashboard (or whatever you named it).

B2. Choose the right permissions

In the Permissions section, add these (type each into the permission search box and click it):

• pages_show_list
• pages_read_engagement
• pages_manage_metadata (only if told we need it for your setup)

B3. Generate the token

Click Generate Access Token. A Facebook approval window pops up, listing what the app wants to do. Approve it, and confirm the dialogue about proceeding as yourself. When you land back in the Explorer, a long token string is visible in the Access Token field at the top. That is your short-lived user access token.

Step C: Turn it into a long-lived user token

Short-lived tokens expire within hours, which would mean repeating all this constantly. Instead we exchange it. Meta provides the Access Token Debugger for this.

C1. Open the Access Token Debugger

Go to developers.facebook.com/tools/debug/accesstoken and paste the token from Step B3 into the box, then click Debug. You will see details including an "Expires" value of roughly one to two hours.

C2. Click Extend Access Token

At the bottom of the debug results, click Extend Access Token. You will receive a new, long token string. Copy it immediately and keep it; it is valid for about 60 days.

Step D: Get the never-expiring Page access token

D1. Back in the Graph API Explorer, select the long-lived token

Return to developers.facebook.com/tools/explorer and paste the long-lived token from Step C2 into the Access Token field.

D2. Call the /me/accounts endpoint

In the query box (where it may already say me), type me/accounts and click Submit. The response lists your Facebook Pages. Find your Page and copy the value next to access_token inside it. That long string is your long-lived Page access token: this is the one that has no expiry date, the one we need.

Step-by-step in short form

1. Register at developers.facebook.com with the Facebook account that administers your Page.
2. Create an app (any name, Business type), then copy the App ID and App Secret from Settings, Basic.
3. Open Graph API Explorer, select your app, add the pages_show_list and pages_read_engagement permissions.
4. Click Generate Access Token, approve the dialogue, copy the short-lived token.
5. Open the Access Token Debugger, debug that token, click Extend Access Token, copy the long-lived token.
6. Back in Graph API Explorer, paste the long-lived token, run me/accounts, and copy the access_token under your Page.
7. Send that Page access token to us securely.

Troubleshooting

"I cannot register as a developer"

Make sure your personal Facebook account is verified (phone number confirmed) and in good standing. Also check you are using the account that has admin rights on the Page; a generic work account may have restrictions.

"I chose the wrong permissions and no Pages appear"

In Graph API Explorer, redo Step B2 with both permissions selected, regenerate the token, and try me/accounts again. Without pages_show_list the response will be empty.

"The token I gave got rejected later"

The most common causes are: we were given a short-lived token instead of the long-lived Page token (redo from Step C), the token belongs to someone who later lost admin rights on the Page, or the password was changed after the token was made (which can invalidate it). Generate a fresh token following the steps above and anything referencing the old one updates instantly.

"I think my token has been exposed somewhere"

Never fear, this is fixable. Either remove the app's access (Facebook settings → Business integrations → remove) or debug/change nothing and simply create a new token and send only the new one. Then tell us so we can update the dashboard.

What we do with your token

Once we have it, the token lives in the configuration of your dashboard on the server, where only our scheduled data-fetching script can reach it. That script quietly asks Facebook for your Page's numbers and files them into your dashboard's database, so every chart you see is up to date: follower counts, reach, engagement. You will never see the token used anywhere, and we will never display it or paste it into any file you might later share.

Why this matters

Facebook is the most layered of the services we connect, which is why this guide is the longest. But once you have walked through it one time and hold that long-lived Page token, it works for the long term with no maintenance, and that is the only step we need from your side.

Frequently asked questions