What a Facebook Page Access Token Is, and Why It Starts With a Person

What is a Facebook Page access token?

Meta defines a Facebook Page access token as the credential that lets an app act as a Page instead of as a person. The access token guide puts it in one line: "Page access tokens let you read, write, and modify data belonging to a Facebook Page." Posting to a Page feed, replying to comments as the Page and reading Page Insights all run on this token.

Meta lists five token types on the same page, and the Page token is the only one tied to a single Page:

The Page token is also the one the Pages API asks for by name. Meta's Pages API overview says "Most endpoints require Page access tokens," and the Pages API error table has a code for calling one of those endpoints with anything else: 190 with subcode 2069032, "A Page access token is required for this call."

How do you get a Page access token?

You get a Page access token by trading a User access token for it. Meta's instruction is two steps long: "To obtain one, first get a user access token, then exchange it for a Page access token via the Graph API." There is no endpoint that issues a Page token to an app that has not first logged a person in.

The exchange is a single GET on the person's accounts edge:

curl -i -X GET "https://graph.facebook.com/{your-user-id}/accounts?access_token={user-access-token}"

Meta says the call "returns a list of Pages you have a role on, including the Page category, your permissions on each Page, and the Page access token." Each object in the data array carries access_token, category, category_list, name, id and a tasks array:

{
  "data": [
    {
      "access_token": "EAACEdE...",
      "category": "Brand",
      "name": "Ash Cat Page",
      "id": "1353269864728879",
      "tasks": ["ANALYZE", "ADVERTISE", "MODERATE", "CREATE_CONTENT", "MANAGE"]
    }
  ]
}

The Pages API overview describes the same flow in four steps: get a User access token "through Facebook Login for Business," query /me/accounts, capture the returned Page ID and token, then "use the ID and token to query the Page node." One login can return several Pages. Meta tells developers to "capture each Page ID and its respective token" in that case, because each Page gets its own string.

Why does posting to a company Page need a personal Facebook login?

Posting to a company Page needs a personal login because the Page token inherits its authority from a person. Meta's overview states the condition: "In order to get a token from an app User, the app User must own or be able to perform a Task on the Page." The Page itself never logs in anywhere. A person with a role on it does, and the token records who that person was.

Meta describes that binding in two slightly different ways on two live pages. The access token guide says Page tokens "are unique to each Page, admin, and app combination." The Pages API overview says they are "unique to each Page, app User, and app." The practical reading is the same either way. Change the Page, the person or the app, and you hold a different token. If the person who connected the Page loses their role, the calls their token makes lose the task check that let them through, which is one of the causes covered in why a social media scheduler keeps disconnecting.

The one route that avoids a personal login is a system user. Meta's Facebook Login for Business configuration lets an app request "a User access token or System-user access token." Choose the User token and "your app users will log in using their personal Facebook account." Choose the system user token and they "will be required to log in using a business portfolio," which Meta says "is only required if this configuration needs continuous access to business assets, such as Facebook Pages." System user tokens depend on the business portfolio owning or sharing the Page, so they suit agencies and in-house teams with Business Manager set up, and they do nothing for a solo creator whose Page sits under a personal profile.

Which permissions does a Page access token need?

A Page access token needs two separate grants to post: permissions that the person approves for the app, and a task that the person holds on the Page. Meta checks both. The overview explains the second check: "we will first check if the User has been approved for a task that permits that type of action."

These are the Page permissions a publishing integration asks for, with Meta's own descriptions from the permissions reference:

The tasks returned in the tasks array map to actions. CREATE_CONTENT lets a person "Publish content as the Page on the Page." MODERATE covers responding to and deleting comments. ANALYZE covers Insights. MANAGE lets a person "Assign and manage Page tasks." Meta adds that "If a person is given Admin access to a Page in the UI, that person is able to perform all tasks on that Page." If the app has pages_manage_posts but the person lacks CREATE_CONTENT, the Pages API returns 1 with subcode 2853006, "Viewer doesn't have permission to perform this action."

Meta's own guides disagree on one name. The Pages API Get Started guide lists four permissions for its first post: pages_manage_metadata, pages_manage_posts, pages_manage_read_engagement and pages_show_list. The permissions reference has no entry called pages_manage_read_engagement. The Manage a Page guide lists pages_read_engagement instead, which is also the dependency the reference gives for pages_manage_posts. Request pages_read_engagement.

App Review sits on top of all of this. The overview says "All Page-related Permissions and Features require approval through the App Review process before your app can use them when your app goes live." Apps in development mode can request any permission, but only from people who have a role on the app.

Does a Facebook Page access token expire?

A Facebook Page access token expires on the same schedule as the User token it came from, until you use a long-lived User token, at which point the Page token stops having an expiry date. Both halves of that come from Meta, on different pages.

The Pages API overview adds a third statement that does not fit the table. It says Page access tokens "have an expiration time," with no qualifier for the long-lived case. The long-lived tokens page says the opposite for tokens derived from a long-lived User token. Read the overview line as describing the default short-lived token, and check a real token with debug_token before trusting either page. The exchange call, the expires_in value of 5183944 and the debug_token fields are covered in the note on the Facebook long-lived access token and its 60-day clock.

"No expiration date" does not mean permanent. Meta's general caveat on token lifetimes applies here too. It says "Do not depend on these lifetimes remaining the same," because "they may change without warning or expire early." Meta's debugging guide names the triggers it documents. A person who "logged out of your app or changed their password" gets code 190, subcode 460, and an app the person de-authorized gets subcode 458. Either one ends a Page token that never had a date on it.

Does a Page access token change how rate limits work?

Yes. Calls made with a Page access token count against a different limit than calls made with a User token. Meta meters Pages API requests made with a Page or system user token under its business use case rate limit, Calls within 24 hours = 4800 * Number of Engaged Users, where engaged users are people "who engaged with the Page per 24 hours." Requests made with User or app tokens fall under the older platform rate limit instead. The formula and the X-Business-Use-Case-Usage header are explained in the note on the Meta business use case rate limit for Pages.

Frequently asked questions

What is the endpoint that returns a Page access token?

GET /{user-id}/accounts, or GET /me/accounts, called with a User access token. The response holds one object per Page with an access_token, name, id, category and the tasks the person can perform on that Page.

Can you get a Page access token without a personal Facebook account?

Only through a system user. Meta's Facebook Login for Business configurations can request a system user token, which requires people to log in with a business portfolio. The portfolio has to own or have access to the Page for that to work.

Is a Page access token the same for every admin of a Page?

No. Meta says Page access tokens "are unique to each Page, admin, and app combination." Two admins who connect the same app to the same Page produce two different tokens.

Why does my Page token say it never expires but still stopped working?

Meta says long-lived Page tokens "only expire or are invalidated under certain conditions." Its debugging guide ties subcode 460 to a person who "logged out of your app or changed their password" and subcode 458 to an app the person no longer authorizes. Both end the token without a date ever being reached.

Which permission lets an app publish to a Page?

pages_manage_posts, which Meta describes as allowing an app to "create, edit and delete your Page posts." It depends on pages_read_engagement and pages_show_list, and the person also needs the CREATE_CONTENT task on the Page.

What error do you get if you call a Page endpoint with a User token?

The Pages API returns code 190 with subcode 2069032 and the message "A Page access token is required for this call." Swap in the Page token from the /accounts response and retry.

What is the difference between a User access token and a Page access token?

A User access token reads or writes "a person's Facebook data on their behalf," while a Page access token reads, writes and modifies "data belonging to a Facebook Page." You get the User token from a login dialog and exchange it for the Page token through /accounts. Most Pages API endpoints require the Page token.

Does a Page access token need App Review?

Yes, before your app goes live. Meta says all Page-related permissions and features require approval through App Review at that point. In development mode an app can request any permission, but only from people who have a role on the app.

What happens to a Page token when the admin who connected it loses their role?

The calls that token makes lose the task check that let them through. Page tokens are unique to each Page, admin and app combination, so the token belongs to that person. Connecting again with someone who still holds the right task gives you a different token.

How do you check whether a Page access token is still valid?

Run it through debug_token and read the result instead of trusting either of Meta's expiry statements. This applies to tokens with no expiration date too, because a logout, a password change or a de-authorization can end them.