Meta App Review: a practical guide to getting approved
Meta App Review is the check your app must pass before it can request permissions from people without a role on it. Apps used only by your own team don't need it. To serve customer accounts, each permission needs Advanced Access: Business Verification, a clear use-case description, a screen recording of the permission in use, and at least one successful API call with it in the last 30 days.
Updated:
In short: when do you need App Review?
App Review is required if your app will be used by anyone without a role on the app or its associated business. If only your team (admins, developers, testers) uses it, you can skip it: every app gets Standard Access to all permissions automatically. A SaaS that serves other people's Pages or Instagram accounts needs Advanced Access for each permission it requests.
Unapproved permissions can only be requested from role holders. During review Meta tests your app itself: if reviewers can't get in, the whole submission is rejected; if they can't see a specific permission in use, only that permission is rejected.
Development mode vs Live mode
| Development | Live | |
|---|---|---|
| Who you can request permissions from | Only people with a role on the app | Anyone |
| Which permissions work | Those with Standard or Advanced Access | Only permissions approved in App Review |
| Data created while testing (e.g. posts) | Visible to role users only | no |
| When to use it | Building and testing | After development and App Review |
yesno
Flipping the mode doesn't replace App Review: even in Live you can't request an unapproved permission from an outside user.
App roles: who can do what
Putting testers in the right role solves a lot of problems before review.
| Role | Capabilities |
|---|---|
| Administrator | Full control: settings, secret reset, role management, any permission while in development |
| Developer | Technical settings and insights; any permission while in development, all features active |
| Tester | Any permission while in development; cannot change settings |
| Analytics User | App analytics only |
Invitees must accept the invitation. If the app is connected to a business portfolio, roles are managed in Business Manager.
Standard Access vs Advanced Access
| Standard Access | Advanced Access | |
|---|---|---|
| Works for | Users with a role on the app only | All users |
| How you get it | Automatic for every app type | App Review + Business Verification |
| Good for | Your own team, internal tools, testing | SaaS products and agencies serving client accounts |
For the Marketing API these tiers are now called Limited Access and Full Access; Full Access requires App Review plus active API traffic with a low error rate.
Which permissions need App Review
The rule is simple: any permission you request from an outside user needs Advanced Access, and therefore App Review. Meta's Permissions Reference spells out, per permission, what the reviewer expects to see.
The usual suspects in social integrations: pages_show_list, pages_read_engagement, pages_manage_posts and pages_manage_metadata for Pages; instagram_business_* for Instagram Login, or instagram_basic, instagram_manage_insights and friends for the Facebook Login path; ads_read and ads_management for ads; leads_retrieval for lead forms.
Mind the dependencies: pages_manage_posts depends on pages_read_engagement and pages_show_list, and so does ads_management. The Socialift SDK reference lists the required permission next to every method — build your list from the methods you actually call.
Submitting for App Review, step by step
Complete the app settings
Settings → Basic: a 1024×1024 icon, a Privacy Policy URL (Meta shows it to users in its login dialogs), an accurate category, the app's purpose (yourself or clients) and a primary contact for notifications.
Get Business Verification done
Apps requesting Advanced Access must be connected to a verified business. Start from App Dashboard → Settings → Basic → Verification.
Make real calls with every permission
Each permission you request Advanced Access for needs at least one successful API call, made within the 30 days before you submit.
Answer the data handling questions
Once Business Verification is approved you may be asked data handling questions. Answers are evaluated immediately.
Write testing instructions
Explain step by step how the reviewer gets into your app. Don't share personal credentials and never use fake Facebook accounts.
Add a description and screen recording per permission
Explain in your own words why you need that exact permission (copied boilerplate isn't allowed) and attach a recording that shows it in use.
Submit
Accept the platform terms and hit Submit — drafts are never reviewed. Meta says you should receive a decision within a week.
Screencast requirements
From Meta's screen recording guidance:
- Record the login flow from start to finish, including non-Meta login options.
- Show the user clicking the login button and choosing which Pages or accounts to grant.
- After authorization, show exactly what your app does with the permission.
- Switch the UI to English; if that's impossible, add captions and hints explaining what's on screen.
- Record in high resolution (1080p or higher) with a monitor width of 1440 pixels or less.
- App window only, an enlarged cursor, no audio.
Common rejection reasons
| Reason | How to avoid it |
|---|---|
| The reviewer couldn't access the app | Provide a working, reachable environment and clear login instructions |
| The recording doesn't show the permission in use | Show the in-app result of every requested permission |
| Unnecessary permissions requested | Ask only for what you use today, not "for later" |
| The app isn't finished | Submit only a product that's ready for users |
| "Log in with Facebook" didn't work | Reviewers will find and press it — test the flow first |
| Fake test account supplied | Fake accounts are prohibited; use app roles for testing |
Partial approval happens: some permissions pass, others don't. Fix the rejected ones per the stated reason and resubmit.
After App Review: Data Use Checkup and Access Verification
Data Use Checkup is an annual assessment where you confirm your use of data from Meta APIs complies with the terms. It goes to admins of apps that are Live or hold Advanced Access and is needed to keep API access. Apps with Standard Access only don't have to complete it.
Access Verification is a separate process for tech providers: a business that serves other businesses' data (for example through ads_management or instagram_business_basic) confirms it operates as a tech provider. It's independent of App Review, requires Business Verification first, and a decision typically takes about 5 days.
Preparing in the Socialift dashboard
Socialift doesn't bypass App Review and isn't a Meta partner: the submission is made by your app, and the reviewer tests your product. The dashboard does speed up preparation.
In "Kalitlar" (Keys) you add your own Meta or Instagram Login app credentials: they're stored encrypted, validated against the provider, and the exact redirect and webhook URLs to paste into the App Dashboard are shown. With your own app, the login dialog shows your brand.
Connect a test account over OAuth in "Ulanishlar" (Connections), then call the methods you need in "Playground" with a real request and response — a quick way to confirm each permission works before you submit. The screencast itself still has to be recorded in your own interface.
Before submitting: confirm the permissions were actually granted
After a test user logs in, check via debug_token which permissions landed on the token.
import asyncio, os
from socialift import Facebook
REQUIRED = {"pages_show_list", "pages_read_engagement", "pages_manage_posts"}
async def main() -> None:
async with Facebook.from_env() as fb:
granted = set(await fb.granted_scopes(os.environ["TEST_USER_TOKEN"]))
print("Missing:", REQUIRED - granted or "all granted")
asyncio.run(main())If a permission isn't on the token, calls that need it won't succeed — and the 30-day successful-call requirement won't be met.
Frequently asked questions
How long does Meta App Review take?
Meta says you should receive a decision within a week of submitting. Business Verification and Access Verification are separate processes with their own timelines, so start them early.
Do I need App Review if only I use the app?
No. If only people with app roles use it, Standard Access is enough and every app gets it automatically. App Review is for customers and other outside users.
Can I get Advanced Access without Business Verification?
Generally no: apps requesting Advanced Access must be connected to a verified business. Starting verification before App Review saves time.
Do I need a separate screencast for each permission?
The submission form asks for a description and a recording per permission. What matters is that each recording clearly shows where and why your app uses that exact permission.
My App Review was rejected — what now?
Read the stated reason: most often the reviewer couldn't access the app, the recording didn't show the permission in use, or unnecessary permissions were requested. Fix it and resubmit the rejected permissions.