{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"meta/facebook-login","name":"Facebook Login","vendor":"Meta","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"\"Sign in with Facebook\" for web and mobile apps, plus Facebook Login for Business for B2B apps. public_profile and email work for anyone without review; every other permission needs App Review.","account_model":{"summary":"A Meta developer account owns a Meta app; Facebook Login is a product added to that app. Consumer-type apps suit \"Sign in with Facebook\" for the public; Business-type apps with Facebook Login for Business suit apps that act on other businesses' assets.","accounts":[{"name":"Meta developer account","kind":"developer","owned_by":"the person","required":true},{"name":"Meta app (Consumer or Business type) with the Facebook Login product","kind":"project","parent":"Meta developer account","required":true},{"name":"Meta Business Portfolio","kind":"organisation","owned_by":"the business","required":false,"note":"Required for Facebook Login for Business (must be separate from your clients' portfolios) and usually for Advanced Access beyond email/public_profile."}],"notes":["The Facebook App ID and App Secret are the OAuth client id and client secret that auth libraries ask for.","Two clocks: the user token lasts about 60 days (SDKs refresh it on use); separately, access to the user's data expires 90 days after they were last active and needs reauthorization."]},"prerequisites":[{"entry":"meta/developer-app"},{"entry":"meta/app-review","note":"Only for permissions beyond public_profile and email."},{"entry":"meta/business-verification","note":"May be required for Advanced Access to some permissions."},{"entry":"meta/business-portfolio","note":"Only for Facebook Login for Business."}],"identity_requires":["app_name","privacy_policy_url","support_email","website"],"have_ready":[{"kind":"live_website","description":"The site or app domain served over HTTPS, and exact redirect URIs (e.g. https://{domain}/api/auth/callback/facebook)","why":"Only https pages are supported for authentication actions; tokens are only returned to listed redirect URIs and domains","needed_for":["login-settings"],"auto_check":"website_live","source_url":"https://developers.facebook.com/documentation/facebook-login/web"},{"kind":"app_privacy_policy_url","description":"Public privacy policy that explains how users request deletion of their data","why":null,"needed_for":["basic-settings"],"auto_check":"website_live","source_url":"https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback"},{"kind":"other","description":"A data deletion callback (HTTPS endpoint returning a status URL and confirmation code) or a page with deletion instructions","why":null,"needed_for":["basic-settings"],"auto_check":"none","source_url":"https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback"},{"kind":"app_icon","description":"App icon for the login dialog and App Review [to verify size for non-Instagram apps]","why":null,"needed_for":["basic-settings"],"auto_check":"none","source_url":null},{"kind":"demo_video","description":"Screencast of each extra permission in use (only if requesting more than public_profile and email)","why":null,"needed_for":["app-review"],"auto_check":"none","source_url":"https://developers.facebook.com/docs/facebook-login/review"}],"steps":[{"id":"create-app","title":"Create a Meta app","summary":"In the App Dashboard create an app. For consumer sign-in pick the authentication use case (Consumer type); for B2B access to other businesses' assets pick a Business type app and use Facebook Login for Business. [to verify the current use-case labels]","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":[],"optional":false,"url":"https://developers.facebook.com/apps/","lead_time":null,"preflight":[],"captures":null},{"id":"login-settings","title":"Add Facebook Login and set redirect URIs and domains","summary":"Add the Facebook Login product, open Settings, enter every Valid OAuth Redirect URI, and if you use the JavaScript SDK switch on Login with JavaScript SDK and add your domain to Allowed Domains.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["create-app"],"optional":false,"url":"https://developers.facebook.com/apps/","lead_time":null,"preflight":[],"captures":null},{"id":"basic-settings","title":"Fill in App settings > Basic","summary":"Add privacy policy URL, data deletion callback or instructions URL, app domain, category and icon. Copy the App ID; the App Secret stays secret.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["create-app"],"optional":false,"url":"https://developers.facebook.com/apps/","lead_time":null,"preflight":["privacy_policy_reachable"],"captures":"FACEBOOK_CLIENT_SECRET"},{"id":"business-config","title":"Create a Facebook Login for Business configuration","summary":"Business apps only. Create a configuration choosing token type (user or system user), assets and permissions; copy its configuration ID. The authorization code is exchanged server-side for a BISU token.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["login-settings"],"optional":true,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"test-with-roles","title":"Test with people who have a role on the app","summary":"Admins, developers and testers on the app can grant any permission without approval, so test the whole flow before review.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":["login-settings","basic-settings"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"app-review","title":"App Review for any permission beyond public_profile and email","summary":"Skip if you only need sign-in with name and email. Otherwise request Advanced Access per permission with a screencast and test instructions. See meta/app-review.","route":"guided","gate":"third_party_review","human_only":true,"gate_label":"The provider reviews it","depends_on":["test-with-roles"],"optional":true,"url":null,"lead_time":{"official":{"text":"Not stated on the App Review overview [to verify]","source_url":"https://developers.facebook.com/docs/facebook-login/review","source_title":"App Review overview"},"reported":null,"typical_minutes":null},"preflight":[],"captures":null},{"id":"go-live","title":"Switch the app to Live mode","summary":"Until Live, only people with a role on the app can log in. Consumer apps must be Live before asking non-role users for Advanced Access permissions; switch email and public_profile to Advanced Access.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["test-with-roles"],"optional":false,"url":"https://developers.facebook.com/apps/","lead_time":null,"preflight":[],"captures":null}],"gates":[{"step":"create-app","gate":"human_submit","label":"You press submit"},{"step":"login-settings","gate":"human_submit","label":"You press submit"},{"step":"basic-settings","gate":"human_submit","label":"You press submit"},{"step":"business-config","gate":"human_submit","label":"You press submit"},{"step":"app-review","gate":"third_party_review","label":"The provider reviews it"},{"step":"go-live","gate":"human_submit","label":"You press submit"}],"lead_times":[{"step":"app-review","what":"App Review for any permission beyond public_profile and email","official":{"text":"Not stated on the App Review overview [to verify]","source_url":"https://developers.facebook.com/docs/facebook-login/review","source_title":"App Review overview"},"reported":null}],"outputs":[{"name":"FACEBOOK_CLIENT_ID","description":"Meta App ID, used as the OAuth client id","secret":false,"example_format":"1234567890123456","environments":null},{"name":"FACEBOOK_CLIENT_SECRET","description":"Meta App Secret, used as the OAuth client secret (server-side only)","secret":true,"example_format":"32 hex characters","environments":null},{"name":"FACEBOOK_LOGIN_CONFIG_ID","description":"Facebook Login for Business configuration ID (Business apps only)","secret":false,"example_format":"123456789012345","environments":null}],"renewals":[{"what":"Long-lived user access token (SDKs refresh it on use; server flows must re-exchange)","every":"about 60 days","every_days":60,"source_url":"https://developers.facebook.com/docs/facebook-login/guides/access-tokens"},{"what":"Data access reauthorization if the user has been inactive","every":"90 days","every_days":90,"source_url":"https://developers.facebook.com/docs/facebook-login/auth-vs-data/"},{"what":"Data Use Checkup for apps with Advanced Access","every":"1 year","every_days":365,"source_url":"https://developers.facebook.com/blog/post/2020/09/10/data-use-checkup-rolling-out-broadly-facebook-platform-developers/"}],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/meta/facebook-login"}