Setting up a Meta app for the Facebook and Instagram APIs

What do you get from a Meta app?

Key terms

Use case

The integration scenario you pick when creating the app (for example “Manage everything on your Page”). Permissions and products come from it. Use cases can't be removed after creation — only compatible ones can be added.

Facebook Login for Business

The login product for Business-type apps. Permissions are chosen in a configuration in the dashboard, and your code passes only its ID (config_id).

Standard vs Advanced Access

With Standard Access only people who have a role on the app can grant permissions. To serve Pages and accounts you don't manage, each permission needs Advanced Access through App Review.

Business Verification

Verifying your company with Meta. An app requesting Advanced Access must be connected to a verified business portfolio.

How to create and configure a Meta app

1. 1

   Create the app

   On developers.facebook.com/apps start creating an app: enter the name and contact email, then choose use cases (for example “Manage everything on your Page”). If you need Facebook Login for Business with config_id and no listed use case fits, choose “Other” and then the Business app type.

2. 2

   Connect a business portfolio

   The wizard offers to connect a verified or unverified business portfolio, or to create one. Connect the company that will own the integration — that's the business you'll verify later for Advanced Access.

3. 3

   Copy the App ID and App Secret

   Both are under App settings → Basic; the App ID is also shown at the top of the dashboard. Keep the secret in environment variables or a secret manager.

4. 4

   Add the redirect URI

   Add the Facebook Login for Business product (your use case may already include it). In its settings, put your callback address into Valid OAuth Redirect URIs. With Strict Mode, Meta requires an exact match: a different path or a query parameter not in the list is rejected.

5. 5

   Create a configuration and copy config_id

   Under Configurations create a configuration (or start from a template): name, access token type, business assets and permissions. Choose User access token: Socialift's login flow exchanges the code for a long-lived user token and then reads Pages. System user tokens require an extra login URL parameter (override_default_response_type) that this flow doesn't send. Copy the Configuration ID.

6. 6

   Add permissions to the use case

   On the use case customization screen, add only the permissions from the table below that your integration actually uses. Per Meta's docs, the most common App Review rejection reason is requesting a permission or feature the app doesn't need.

7. 7

   Configure webhooks

   Your endpoint needs HTTPS with a valid certificate (self-signed isn't supported). Enter the Callback URL and Verify token, confirm, then subscribe to fields: Page object — leadgen (Lead Ads) and feed (posts and comments); Instagram object — comments, mentions and messages for Direct. Each Page must then install the app via subscribed_apps — without it no events arrive.

8. 8

   Add roles and testers

   In the Roles panel invite administrators, developers and testers. Until App Review, permissions can be granted only by people with a role on the app (or on the business that owns it) — that's how you test with your own Pages.

9. 9

   Pass App Review and Business Verification

   To serve Pages and accounts you don't manage, each permission needs Advanced Access. Every permission needs its own description and a screen recording (the user grants it, the app uses it); at least one successful API call with that permission within 30 days before submitting; a privacy policy URL and a 1024×1024 app icon. Advanced Access requires Business Verification.

How to add the Meta app to Socialift

1. 1

   Open “Kalitlar” → “Meta (Facebook) app”

   In the dashboard open “Kalitlar” (Keys) and expand the “Meta (Facebook) app” card. The side block “Konsolga ko'chiring” (Copy to console) shows the Redirect URI even before you save a key — paste it into Valid OAuth Redirect URIs.

2. 2

   Fill in the fields

   App ID and App secret are required. Configuration ID is optional: when set, the login URL carries config_id and the “Scope'lar” (Scopes) field is not used. Leave it empty for a Consumer app — then the scope list is sent (empty “Scope'lar” = default list, comma- or space-separated).

3. 3

   Click “Saqlash va tekshirish” (Save and verify)

   Socialift asks Meta for an app access token with your ID and secret: a match marks the key as verified, a rejection shows Meta's error. This checks only the ID/secret pair — the redirect URI, config_id and permissions are checked on the first real login. The secret is stored encrypted and never returned in full; leave the field empty when editing to keep the current one.

4. 4

   Copy the webhook and callback URLs

   After saving, the card shows Webhook URL, Webhook verify token, Deauthorize callback and Data deletion callback. Your app gets its own webhook URL, and incoming events are verified with your App Secret. Paste the webhook pair into the Webhooks settings, the deauthorize URL into the Facebook Login settings and the data deletion URL into the field under App settings → Basic.

5. 5

   Connect an account and sync Pages

   In “Ulanishlar” (Connections) click “Ulash” (Connect) on the Facebook card, then “Page'larni sinxronlash” (Sync Pages) — your Pages and their linked Instagram accounts are added. Subscribe each Page to webhooks from Playground (the “Page'lar va webhook” section) or with fb.subscribe_page in the SDK.

Which permissions does the app need?

This is Socialift's default “Scope'lar” list. When you use config_id, choose the same permissions inside the configuration.

Using the keys in the Python SDK

Facebook.from_env() reads FACEBOOK_APP_ID, FACEBOOK_APP_SECRET, FACEBOOK_CONFIG_ID and META_GRAPH_VERSION from the environment.

import asyncio
import secrets

from socialift import Facebook

REDIRECT_URI = "https://example.com/auth/facebook/callback"  # same as in Valid OAuth Redirect URIs


async def main() -> None:
    # FACEBOOK_APP_ID, FACEBOOK_APP_SECRET, FACEBOOK_CONFIG_ID, SOCIALIFT_LICENSE_KEY
    async with Facebook.from_env() as fb:
        state = secrets.token_urlsafe(32)  # store in the session, compare in the callback
        print(fb.login_url(redirect_uri=REDIRECT_URI, state=state))

        code = input("code: ")
        token = await fb.exchange_code(code, redirect_uri=REDIRECT_URI)
        print(await fb.granted_scopes(token.access_token))  # permissions actually granted
        for page in await fb.pages(token.access_token):
            await fb.subscribe_page(page.id, page.access_token, fields=["leadgen", "feed"])


asyncio.run(main())

Common mistakes

• ▸The redirect URI differs from Valid OAuth Redirect URIs (http vs https, trailing /, an extra query parameter).
• ▸Instagram app ID/secret entered in the Meta card (or the other way round) — they are different keys.
• ▸The configuration uses a System user access token — Socialift's login flow expects a User access token.
• ▸Configuration ID is set, but permissions are being changed in “Scope'lar” — in that case change them in the configuration.
• ▸Webhooks are configured at app level, but the Page isn't subscribed via subscribed_apps — no events arrive.
• ▸Testing before App Review with an account that has no role on the app — permissions aren't granted.
• ▸Advanced Access requested for permissions the app doesn't use — App Review rejects it.
• ▸The App Secret sits in frontend code or in a repository.