How to get a Facebook Page access token

In short: how do you get a Page access token?

Meta token types and lifetimes

Who each token acts for and how long it lives, per Meta's documentation.

Meta warns that these lifetimes may change without notice and tokens can expire early. Key your logic off API errors, not dates.

Getting a never-expiring Page token in 5 steps

1. 1

   Configure the app

   Add Facebook Login in the Meta App Dashboard and register the exact redirect URI. In a Business-type app (Facebook Login for Business) permissions live in a configuration, and the login URL carries config_id instead of scope.

2. 2

   Send the user to login

   Add a random state to the URL (CSRF protection) and keep it in the session. The minimum is pages_show_list; add the rest per use case (pages_manage_posts for publishing, and so on).

3. 3

   Exchange the code on the server

   In the callback, compare state, exchange code for a short-lived user token, then use fb_exchange_token to get a long-lived one. The app secret stays on the server — Meta requires server-side token generation anyway.

4. 4

   Fetch the Page tokens

   Call GET /me/accounts with the long-lived user token. Each Page comes back with id, name, access_token and the tasks the user can perform.

5. 5

   Inspect and store encrypted

   Check expires_at, data_access_expires_at and scopes in the Access Token Debugger or via debug_token. Store the token encrypted and keep it out of the frontend and logs.

Python: from login to Page token

With the Socialift SDK the whole flow is four methods: login_url, exchange_code, granted_scopes, pages.

import secrets
from socialift import Facebook

REDIRECT = "https://example.com/facebook/callback"
SCOPES = ["pages_show_list", "pages_read_engagement", "pages_manage_posts"]

def login_link(fb: Facebook) -> tuple[str, str]:
    state = secrets.token_urlsafe(32)  # keep it in the session
    return fb.login_url(redirect_uri=REDIRECT, state=state, scopes=SCOPES), state

async def on_callback(code: str) -> None:
    async with Facebook.from_env() as fb:
        user = await fb.exchange_code(code, redirect_uri=REDIRECT)  # ~60 days
        granted = await fb.granted_scopes(user.access_token)
        missing = set(SCOPES) - set(granted)
        if missing:
            raise RuntimeError(f"Declined permissions: {missing}")
        for page in await fb.pages(user.access_token):
            save_page(page.id, page.name, page.access_token)  # encrypt

Which permissions a Page integration needs

Dependencies from the Permissions Reference — request the dependencies along with the permission.

yesno

Permissions granted, still can't post? Check Page tasks

Why a Page token stops working

The Graph API distinguishes token problems by error_subcode. The common ones:

The top-level code is usually 190. The Socialift SDK raises code 190 as AuthError — catch it and move the account to a "reconnect required" state.

Data access expiration (90 days) is a separate clock

System user tokens: server-to-server without a human

Disconnecting: revoke the token properly

Deleting the token from your database isn't enough — the permission stays alive on Facebook's side.

from socialift import AuthError, Facebook

async def disconnect(user_token: str, account_id: int) -> None:
    async with Facebook.from_env() as fb:
        print("Granted:", await fb.granted_scopes(user_token))
        try:
            await fb.revoke(user_token)  # DELETE /me/permissions
        except AuthError:
            pass  # token already invalid — nothing left on Meta's side
    delete_tokens(account_id)  # remove user and Page tokens from your DB

Production checklist

• ▸Derive Page tokens only from a long-lived user token.
• ▸Check granted_scopes and show declined permissions in your UI.
• ▸Store tokens encrypted; keep them out of the frontend, logs and error reports.
• ▸Send appsecret_proof with every call (the SDK adds it automatically).
• ▸On error 190, flag the account as "reconnect required" and notify the owner.
• ▸On disconnect, call revoke and delete the tokens.