{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"5de8a4780127367be11ee7cbb40122bd39a11af1695c4cadc20e001ade1e2815","entry":{"id":"meta/facebook-login","name":"Facebook Login","vendor":"Meta","summary":"\"Sign in with Facebook\" for web and mobile apps, plus Facebook Login for Business for B2B apps. public_profile and email work for anyone without review; every other permission needs App Review.","aliases":["facebook-oauth","sign-in-with-facebook","facebook-login-for-business","fb-login"],"category":"auth","group":"B","homepage":"https://developers.facebook.com/docs/facebook-login/","docs":["https://developers.facebook.com/docs/facebook-login/overview","https://developers.facebook.com/documentation/facebook-login/web","https://developers.facebook.com/docs/facebook-login/facebook-login-for-business/"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"fbl-overview","url":"https://developers.facebook.com/docs/facebook-login/overview","title":"Facebook Login – Overview","accessed":"2026-10-25","supports":"Login for iOS, Android, web, desktop and devices; public_profile and email can be asked of anyone without review; any other permission needs review; people with a role on the app can grant any permission without approval; apps must offer data deletion (contact email or callback)","kind":"official"},{"id":"fbl-web","url":"https://developers.facebook.com/documentation/facebook-login/web","title":"Facebook Login for the Web with the JavaScript SDK","accessed":"2026-10-25","supports":"Valid OAuth Redirect URIs, Login with JavaScript SDK toggle, Allowed Domains for JavaScript SDK; only https pages supported for authentication actions","kind":"official"},{"id":"fbl-tokens","url":"https://developers.facebook.com/docs/facebook-login/guides/access-tokens","title":"Facebook Login – Access tokens","accessed":"2026-10-25","supports":"Short-lived tokens about 1-2 hours, long-lived about 60 days, exchange needs the app secret server-side; lifetimes may change without warning","kind":"official"},{"id":"fbl-auth-vs-data","url":"https://developers.facebook.com/docs/facebook-login/auth-vs-data/","title":"Facebook Login – Authentication versus data access","accessed":"2026-10-25","supports":"Data access expires 90 days after the user was last active; app must ask the user to reauthorize (reauthorizeDataAccess / auth_type reauthorize)","kind":"official"},{"id":"fbl-business","url":"https://developers.facebook.com/docs/facebook-login/facebook-login-for-business/","title":"Facebook Login for Business","accessed":"2026-10-25","supports":"Configurations created in the App Dashboard; logins only from web surfaces; app must belong to a business portfolio you control, separate from the client's; code exchanged server-side for a business integration system user (BISU) token","kind":"official"},{"id":"access-levels","url":"https://developers.facebook.com/docs/graph-api/overview/access-levels","title":"Graph API – Access levels","accessed":"2026-10-25","supports":"Standard vs Advanced Access; Business apps auto-approved for Standard Access; new Consumer apps get Advanced Access to email and public_profile but must switch it on, and must be Live first; Advanced Access may need a verified business; Data Use Checkup for Advanced Access","kind":"official"},{"id":"app-review-overview","url":"https://developers.facebook.com/docs/facebook-login/review","title":"App Review overview","accessed":"2026-10-25","supports":"Apps used by people without a role need App Review; if Meta cannot access the app to test it the entire submission is rejected; untestable functionality is not approved","kind":"official"},{"id":"data-deletion","url":"https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback","title":"Data deletion request callback","accessed":"2026-10-25","supports":"Apps that access user data must offer deletion; privacy policy must say how; either a Data Deletion Request URL (HTTPS callback returning url and confirmation_code) or an instructions URL","kind":"official"},{"id":"duc-blog","url":"https://developers.facebook.com/blog/post/2020/09/10/data-use-checkup-rolling-out-broadly-facebook-platform-developers/","title":"Meta for Developers blog – Data Use Checkup rolling out broadly","accessed":"2026-10-25","supports":"Annual Data Use Checkup; missing the deadline loses access to the relevant platform features","kind":"official"},{"id":"platform-terms","url":"https://developers.facebook.com/terms/","title":"Meta Platform Terms","accessed":"2026-10-25","supports":"No selling or licensing Platform Data (3.a.iv); privacy policy (4.a); delete data on request (3.d); protect app secrets and tokens (6.a.iv); enforcement incl. permanent removal (7.e)","kind":"official"},{"id":"discourse-90-days","url":"https://meta.discourse.org/t/facebook-login-fails-because-access-token-is-invalidated-after-90-days/86647","title":"Discourse Meta – Facebook login fails because access token is invalidated after 90 days","accessed":"2026-10-25","supports":"Developers seeing \"The access token is invalid since the user hasn't engaged the app in longer than 90 days\"","kind":"community"}],"allowed_domains":["developers.facebook.com","facebook.com"],"account_model":{"summary":"A Meta developer account owns a Meta app; Facebook Login is a product added to that app. Consumer-type apps suit \"Sign in with Facebook\" for the public; Business-type apps with Facebook Login for Business suit apps that act on other businesses' assets.","accounts":[{"name":"Meta developer account","kind":"developer","owned_by":"the person","required":true},{"name":"Meta app (Consumer or Business type) with the Facebook Login product","kind":"project","parent":"Meta developer account","required":true},{"name":"Meta Business Portfolio","kind":"organisation","owned_by":"the business","required":false,"note":"Required for Facebook Login for Business (must be separate from your clients' portfolios) and usually for Advanced Access beyond email/public_profile."}],"notes":["The Facebook App ID and App Secret are the OAuth client id and client secret that auth libraries ask for.","Two clocks: the user token lasts about 60 days (SDKs refresh it on use); separately, access to the user's data expires 90 days after they were last active and needs reauthorization."]},"prerequisites":[{"entry":"meta/developer-app"},{"entry":"meta/app-review","note":"Only for permissions beyond public_profile and email."},{"entry":"meta/business-verification","note":"May be required for Advanced Access to some permissions."},{"entry":"meta/business-portfolio","note":"Only for Facebook Login for Business."}],"identity_requires":["app_name","privacy_policy_url","support_email","website"],"have_ready":[{"kind":"live_website","description":"The site or app domain served over HTTPS, and exact redirect URIs (e.g. https://{domain}/api/auth/callback/facebook)","why":"Only https pages are supported for authentication actions; tokens are only returned to listed redirect URIs and domains","needed_for":["login-settings"],"auto_check":"website_live","source":"fbl-web"},{"kind":"app_privacy_policy_url","description":"Public privacy policy that explains how users request deletion of their data","needed_for":["basic-settings"],"auto_check":"website_live","source":"data-deletion"},{"kind":"other","description":"A data deletion callback (HTTPS endpoint returning a status URL and confirmation code) or a page with deletion instructions","needed_for":["basic-settings"],"auto_check":"none","source":"data-deletion"},{"kind":"app_icon","description":"App icon for the login dialog and App Review [to verify size for non-Instagram apps]","needed_for":["basic-settings"],"auto_check":"none"},{"kind":"demo_video","description":"Screencast of each extra permission in use (only if requesting more than public_profile and email)","needed_for":["app-review"],"auto_check":"none","source":"app-review-overview"}],"steps":[{"id":"create-app","title":"Create a Meta app","summary":"In the App Dashboard create an app. For consumer sign-in pick the authentication use case (Consumer type); for B2B access to other businesses' assets pick a Business type app and use Facebook Login for Business. [to verify the current use-case labels]","route":"guided","depends_on":[],"gate":"human_submit","url":"https://developers.facebook.com/apps/","sources":["access-levels","fbl-business"]},{"id":"login-settings","title":"Add Facebook Login and set redirect URIs and domains","summary":"Add the Facebook Login product, open Settings, enter every Valid OAuth Redirect URI, and if you use the JavaScript SDK switch on Login with JavaScript SDK and add your domain to Allowed Domains.","route":"guided","depends_on":["create-app"],"gate":"human_submit","url":"https://developers.facebook.com/apps/","recovery":[{"hiccup":"\"URL blocked\" or redirect URI not whitelisted error at login","fix":"Add the exact callback URL (scheme, host, path) to Valid OAuth Redirect URIs; the login page must be https.","source":"fbl-web"}],"sources":["fbl-web"]},{"id":"basic-settings","title":"Fill in App settings > Basic","summary":"Add privacy policy URL, data deletion callback or instructions URL, app domain, category and icon. Copy the App ID; the App Secret stays secret.","route":"guided","depends_on":["create-app"],"gate":"human_submit","url":"https://developers.facebook.com/apps/","preflight":["privacy_policy_reachable"],"capture":{"env":"FACEBOOK_CLIENT_SECRET","kind":"secret"},"sources":["data-deletion"]},{"id":"business-config","title":"Create a Facebook Login for Business configuration","summary":"Business apps only. Create a configuration choosing token type (user or system user), assets and permissions; copy its configuration ID. The authorization code is exchanged server-side for a BISU token.","route":"guided","depends_on":["login-settings"],"gate":"human_submit","optional":true,"sources":["fbl-business"]},{"id":"test-with-roles","title":"Test with people who have a role on the app","summary":"Admins, developers and testers on the app can grant any permission without approval, so test the whole flow before review.","route":"guided","depends_on":["login-settings","basic-settings"],"gate":"none","sources":["fbl-overview"]},{"id":"app-review","title":"App Review for any permission beyond public_profile and email","summary":"Skip if you only need sign-in with name and email. Otherwise request Advanced Access per permission with a screencast and test instructions. See meta/app-review.","route":"guided","depends_on":["test-with-roles"],"gate":"third_party_review","lead_time":{"official":{"text":"Not stated on the App Review overview [to verify]","source":"app-review-overview"}},"recovery":[{"hiccup":"Whole submission rejected","fix":"Reviewers must be able to reach and test the app; provide working test access and instructions.","source":"app-review-overview"}],"optional":true,"sources":["app-review-overview"]},{"id":"go-live","title":"Switch the app to Live mode","summary":"Until Live, only people with a role on the app can log in. Consumer apps must be Live before asking non-role users for Advanced Access permissions; switch email and public_profile to Advanced Access.","route":"guided","depends_on":["test-with-roles"],"gate":"human_submit","url":"https://developers.facebook.com/apps/","recovery":[{"hiccup":"Other people cannot log in or email comes back empty","fix":"Switch the app to Live and make sure email and public_profile are set to Advanced Access.","source":"access-levels"}],"sources":["access-levels"]}],"outputs":[{"name":"FACEBOOK_CLIENT_ID","description":"Meta App ID, used as the OAuth client id","secret":false,"example_format":"1234567890123456","from_step":"create-app"},{"name":"FACEBOOK_CLIENT_SECRET","description":"Meta App Secret, used as the OAuth client secret (server-side only)","secret":true,"example_format":"32 hex characters","from_step":"basic-settings"},{"name":"FACEBOOK_LOGIN_CONFIG_ID","description":"Facebook Login for Business configuration ID (Business apps only)","secret":false,"example_format":"123456789012345","from_step":"business-config"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Never expose the app secret","text":"The Platform Terms require you to protect and never transfer, share or solicit access tokens or app secrets. Keep the App Secret server-side only. Plain-English summary, not legal advice.","source":"platform-terms"},{"kind":"rules_say","severity":"red","title":"Data deletion and privacy policy are mandatory","text":"Apps that access user data must keep a privacy policy, delete Platform Data on request, and give users a deletion route (callback or instructions URL). Breaches can lead to app suspension or removal.","source":"platform-terms"},{"kind":"rules_say","severity":"amber","title":"Data access lapses after 90 days of inactivity","text":"Even while login still works, access to a user's data expires 90 days after they were last active; the app must prompt them to reauthorize.","source":"fbl-auth-vs-data"},{"kind":"rules_say","severity":"amber","title":"Annual Data Use Checkup","text":"Apps with Advanced Access must recertify their data use every year or lose access to those features.","source":"duc-blog"}],"renewals":[{"what":"Long-lived user access token (SDKs refresh it on use; server flows must re-exchange)","every":"about 60 days","every_days":60,"source":"fbl-tokens"},{"what":"Data access reauthorization if the user has been inactive","every":"90 days","every_days":90,"source":"fbl-auth-vs-data"},{"what":"Data Use Checkup for apps with Advanced Access","every":"1 year","every_days":365,"source":"duc-blog"}],"api_provisioning":{"available":"no","notes":"App creation, Login settings, configurations and App Review are dashboard-only. Tokens come from the OAuth flow.","source":"fbl-overview"},"detect":{"env_names":["FACEBOOK_CLIENT_ID","FACEBOOK_CLIENT_SECRET","AUTH_FACEBOOK_ID","AUTH_FACEBOOK_SECRET","FACEBOOK_APP_ID","FACEBOOK_APP_SECRET"],"packages":["next-auth","passport-facebook","react-native-fbsdk-next"]}}}