Meta (Facebook & Instagram)
Library guide, researched by Claude Code agents, checked 2026-10-19. Setup not tested by hand.
Anyone can create a Meta app and test it right away with people who have a role on it, but letting outside users connect their Pages or Instagram professional accounts needs Advanced Access, which means App Review, Business Verification and, for Page and Instagram permissions, Tech Provider access verification. Expect one to three working days of preparation (screencasts per permission, test instructions, privacy policy, business documents) and roughly one to six weeks of waiting, plus an annual Data Use Checkup.
Tier 4: Review plus external requirements
- Hands-on work
- 8–24 hours
- Waiting for approval
- 7–45 days
- Confidence
- high
Assumes: Public multi-tenant app (Meta calls this a Tech Provider) using Facebook Login for Business so that any external user can connect the Facebook Pages they manage and the Instagram professional accounts linked to those Pages, and let an agent read and act on them. Typical scopes: pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_posts, pages_manage_engagement, instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights (plus instagram_manage_messages / pages_messaging if the agent handles DMs). Every one of these needs Advanced Access.
Solid dark bar: your hands-on work. Amber: the minimum wait. Hatched: the range sources disagree on, or an open-ended wait.[5][7][15][16]
Biggest blocker: Business Verification of a legal entity is required for Advanced Access (and is the prerequisite for Tech Provider access verification), so an individual developer without a registered business cannot let outside users connect their Pages or Instagram accounts.[2][6][7]
Recurring: Annual Data Use Checkup for every app with Advanced Access: re-certify permissions, answer data handling questions and give testing instructions. Notices go out 60 days before the deadline.[2][8][11] Annual Data Protection Assessment for apps that Meta enrolls (sent by email or Alert Inbox), with 60 days to complete it or risk losing access.[10] User and Page tokens: long-lived user tokens last about 60 days, so users must re-authenticate or the app must refresh them.[13]
Why tier 4? Set by: business verification.
| Self-serve credentials | Yes | Any registered Meta developer can create an app in the App Dashboard and get an App ID and secret. New apps are automatically approved for Standard Access to all permissions, which works for people with a role on the app.[1][2] |
|---|---|---|
| Limits until reviewed | Yes | Until Advanced Access is approved, permissions can only be requested from people who have a role on the app (admins, developers, testers) or on the business that claimed it. There is no numeric cap: non-role users simply cannot grant the permissions.[1][3] |
| Provider review | Yes | App Review is required before anyone without a role on the app (or on the claiming business) can grant the permissions. Each permission is reviewed separately and needs its own description and screencast.[4][5][12] |
| Security assessment | No | There is no third-party audit like Google CASA. Meta does have its own self-attested questionnaires: data handling questions during review, an annual Data Use Checkup, and an annual Data Protection Assessment for some apps that is sent by invitation. Answers that are incomplete or vague can cost you platform access.[9][10] |
| Business verification | Yes | Advanced Access requires the app to be connected to a verified Business (legal entity documents in Meta Business Manager). Page and Instagram permissions also trigger a separate Tech Provider 'access verification', which requires Business Verification first.[2][6][7][15] |
| Mandatory fees | No | None of the App Review, Business Verification or access verification docs mention a fee. Graph API calls are not billed; they are rate-limited. (no source) |
| Partner or paid access | No | There is no partner program or paid tier. Tech Provider access verification is a self-serve form that a business admin fills in after Business Verification, with a decision in about 5 days. It is an extra verification, not a sales gate.[7] |
You can start today without any of this. Composio already provides a managed OAuth app for Meta (Facebook & Instagram) (facebook, instagram, metaads), so users can connect while you work through your own app. You need your own app for your brand on the consent screen, your own rate limits, or scopes beyond the defaults. Managed auth list
If your case is different
- Facebook Login only (public_profile, email)
- Meta's Facebook Login docs say apps can request public_profile and email from anyone without App Review. New Consumer apps are automatically approved for Advanced Access to both, but you have to switch them from Standard to Advanced by hand and the app must be in Live mode. You still need a privacy policy URL and a data deletion method, and to switch to Live you must complete the Data Use Checkup.
- Own Pages / Instagram accounts only
- If the app only serves Pages or Instagram professional accounts that you or your business manage, Standard Access is enough. You need no App Review and no Business Verification: just give the people involved a role on the app or on the business that claims it.
- Instagram API with Instagram Login
- This path works for Instagram professional accounts that have no linked Facebook Page. It uses its own scopes (instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_messages), but you still need App Review, Advanced Access and Business Verification for outside accounts. An app can use either Facebook Login or Instagram Login, not both, and only web supports this login.
- Personal Instagram accounts
- Not supported. The Instagram Platform only serves professional (business or creator) accounts.
Steps
Agent steps an AI agent can do or draft for you. You steps that need your identity, accounts, legal authority or a real demo.
Register as a Meta developer and create the app
YouSign in with a Facebook account, register as a developer and accept the terms, then create an app with the Pages / Instagram (Facebook Login for Business) use cases. You get the App ID and secret immediately.[1]
Build and test with role users (Standard Access)
AgentAdd teammates as Testers or Developers, connect a test Page and a linked Instagram professional account, and build the flows. Make at least one successful API call with each permission you will request; the Request advanced access button stays grey until the call has been logged (which can take up to 2 days), and the call must be within 30 days of submitting.[3][5]
Wait for Business Verification
YouWaitMeta's help center says a decision can take up to 14 business days. Clean cases are often faster.[15]
Complete Tech Provider access verification
YouA business admin categorizes and describes how the business uses other businesses' data, under App Dashboard > Basic > Verifications > Access verification. This is required for pages_* and instagram_* permissions used by other businesses.[7]
Draft per-permission usage descriptions and reviewer test instructions
AgentWrite one specific description for each permission (no copy-paste), plus step-by-step instructions for reviewers to reach and test the app. Reviewers use their own test accounts, so if your login is not Meta-based, give them test credentials for your app.[5][12]
Answer data handling questions and submit for App Review
YouAnswer the data handling questions, confirm the app settings, then submit and accept the Platform Onboarding Terms.[5]
What you will need
- A verified Business (legal entity) in Meta Business Manager, connected to the app[6]
- Tech Provider access verification for the business (needed for pages_* and instagram_* permissions used by other businesses)[7]
- Publicly reachable privacy policy URL[5]
- Data deletion: instructions in the privacy policy, or a data deletion request callback over HTTPS[14]
- 1024x1024 app icon with no Meta trademarks or logos[5]
- One screencast and one written description per requested permission[5][12]
- A testable app (public, or with access instructions and test credentials for reviewers)[4][12]
- At least one successful API call per permission within 30 days before submitting[5]
- End users must have an Instagram professional account, linked to a Page they can administer if you use Facebook Login[18]
Nuances that catch people out
- Switching to Live mode before approval breaks the app even for role users, because Live apps can only use approved permissions. Test data created in development mode also becomes visible to everyone once you switch.[5]
- Without access verification, Page and Instagram endpoints called for non-role users fail with a misleading error code 100 ('Unsupported get request ... does not exist') rather than a permission error.[7]
- Changing a permission from Advanced back to Standard immediately cuts off every user without a role. Restoring Advanced Access to a previously approved permission does not need re-review.[2]
- Changing the app's basic or advanced settings after submitting may trigger re-review.[5]
- Long-lived user tokens last about 60 days. Page tokens derived from them must be handled carefully or users must reconnect.[13]
- Graph API rate limits scale with daily active users (200 calls per hour times the number of users, for app tokens). Page tokens and the Instagram Platform use Business Use Case limits instead.[19]
- An app can use Facebook Login or Instagram Login for Instagram, not both. Choose before you submit.[12]
- Verified status is lost if the app is disconnected from its business or the business account becomes restricted.[7]
If you get stuck or rejected
- Whole submission rejected because reviewers could not access or log into the app
- Give public access or clear step-by-step login instructions, plus working test credentials that do not need 2FA, email verification or an IP allowlist. Do not provide your personal Meta account.[4][5][16]
- Individual permission rejected because the screencast did not show it being used
- Record each permission separately: show the Meta consent dialog granting it, then the in-app action that uses it, with captions.[5][12]
- Permission rejected as not needed or outside its allowed usage
- Request only the permissions the current build actually uses, and check each one's Allowed Usage section before you submit.[5][12]
- 'Request advanced access' button is greyed out
- Make a successful call with that permission (in your app or Graph API Explorer) and wait up to 2 days for it to be logged.[5]
- Business Verification rejected
- Make the legal name and address in Business Manager match the registration documents exactly, then resubmit.[16]
- Data Use Checkup answers need changes
- You have 20 calendar days to resubmit, and the app stays active meanwhile. After every third attempt there is a 3-day cooldown.[11]
Evidence
What we could not verify
- The current official App Review turnaround is unclear. The submission guide says 'within a week', but a 2026 vendor blog reports the dashboard now warns of up to 20 days. I could not see the dashboard to confirm this.
- The Meta Business Help Center page on Business Verification is rendered by JavaScript, so its '14 business days' figure is cited through a secondary guide that quotes it.
- Whether a sole proprietor or individual can pass Business Verification in every country was not established.
- The App Review FAQ page did not render to a plain fetch, so I could not check its content.
Sources
Each quote was checked by code against the live page. “Not found on page” means the quote may be paraphrased, so treat that claim with care.
- Access Levels - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
All Business, Consumer, and Gaming apps are automatically approved for Standard Access for all permissions and features. Advanced Access, however, must be approved on an individual permission and feature basis through the App Review process.
- Access Levels - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Permissions with Advanced Access can be requested from any app user, and features with Advanced Access are active for all app users. However, Business Verification is required to get Advanced Access.
- App Modes - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Apps in Development mode can only request permissions from role users, and only permissions with standard or advanced access levels
- App Review process - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
If your app will be used by anyone without a Role on the app or a role in a Business ... that has claimed the app, it must first undergo App Review.
- App Review Submission Guide - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Once you accept the terms and submit, your submission will be queued and you should receive a decision within a week.
- Business Verification - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Apps that request advanced access for permissions and apps that allow other Businesses ... to access their own data must be connected to a Business that has completed Business Verification.
- Access Verification - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
To complete verification, any person with Admin access on the business must categorize and describe how the business uses other businesses' data to provide a service for those businesses. Once a business admin has completed the process a decision will be made within approximately 5 days.
- Data Use Checkup - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
The Data Use Checkup is an annual assessment that evaluates whether a developer's continued use of and access to specific data via Meta APIs is in compliance with our Meta Platform Terms and Developer Policies.
- App Review content - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Starting on or after June 12th, 2023, if your app requires advanced level access to permissions or features, you will need to complete business verification and data handling questions as part of the app review process.
- Data Protection Assessment - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
The Data Protection Assessment is a questionnaire that is an annual requirement for apps accessing certain types of data.
- Data Use Checkup FAQ - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
If changes to your data handling practices are required, you will have 20 calendar days to resubmit acceptable responses.
- Instagram Platform App Review - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Upload a screencast showing the end-to-end user experience for that specific permission or feature.
- Long-lived access tokens - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
If you need a long-lived User access token you can generate one from a short-lived User access token. A long-lived token generally lasts about 60 days.
- Data Deletion Callback - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Apps that access user data must provide a way for users to request that their data be deleted.
- Meta Business Verification 2026: Documents & ApprovalSecondary sourceQuote found on pagechecked 2026-10-19
Meta's official documentation currently says that a business verification decision may take up to 14 business days
- Meta App Review Now Takes 20 Days (bundle.social)Secondary sourceQuote found on pagechecked 2026-10-19
Meta is now explicitly telling developers to expect a 20-day wait for most submissions.
- Pages API Overview - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
For Business apps, which do not have app modes, permissions must be approved for Advanced access before they can be granted to your app by an app user without a role on the app itself or a role in a Business that has claimed it.
- Instagram Platform Overview - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Advanced Access is the access level required if your app serves Instagram professional accounts that you don't own or manage and can be used by app users who do not have a role on your app or a role on a business portfolio that has claimed your app. This access level requires App Review and Business Verification.
- Rate Limits - Meta for DevelopersProvider docsQuote found on pagechecked 2026-10-19
Graph API requests are subject to Platform Rate Limits , while Marketing API and Instagram Platform requests are subject to Business Use Case (BUC) Rate Limits .