Never expose the app secret
The Platform Terms require you to protect and never transfer, share or solicit access tokens or app secrets. Keep the App Secret server-side only. Plain-English summary, not legal advice. [10]
Guides · auth · Verification-gated
Facebook Login
"Sign in with Facebook" for web and mobile apps, plus Facebook Login for Business for B2B apps. public_profile and email work for anyone without review; every other permission needs App Review.
Researched · not yet run liveLast researched 25 October 2026 · Meta · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
A Meta developer account owns a Meta app; Facebook Login is a product added to that app. Consumer-type apps suit "Sign in with Facebook" for the public; Business-type apps with Facebook Login for Business suit apps that act on other businesses' assets.
- Meta developer account developer owned by the person
- Meta app (Consumer or Business type) with the Facebook Login product project · under Meta developer account
- Meta Business Portfolio organisationoptional owned by the businessRequired for Facebook Login for Business (must be separate from your clients' portfolios) and usually for Advanced Access beyond email/public_profile.
The Facebook App ID and App Secret are the OAuth client id and client secret that auth libraries ask for.
Two clocks: the user token lasts about 60 days (SDKs refresh it on use); separately, access to the user's data expires 90 days after they were last active and needs reauthorization.
Have ready
- meta/developer-app
- meta/app-review: Only for permissions beyond public_profile and email.
- meta/business-verification: May be required for Advanced Access to some permissions.
- meta/business-portfolio: Only for Facebook Login for Business.
- The site or app domain served over HTTPS, and exact redirect URIs (e.g. https://{domain}/api/auth/callback/facebook) · Only https pages are supported for authentication actions; tokens are only returned to listed redirect URIs and domains [2]Needed for: Add Facebook Login and set redirect URIs and domains
- Public privacy policy that explains how users request deletion of their data [8]Needed for: Fill in App settings > Basic
- A data deletion callback (HTTPS endpoint returning a status URL and confirmation code) or a page with deletion instructions [8]Needed for: Fill in App settings > Basic
- App icon for the login dialog and App Review [to verify size for non-Instagram apps] Needed for: Fill in App settings > Basic
- Screencast of each extra permission in use (only if requesting more than public_profile and email) [7]Needed for: App Review for any permission beyond public_profile and email
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Create a Meta app
In the App Dashboard create an app. For consumer sign-in pick the authentication use case (Consumer type); for B2B access to other businesses' assets pick a Business type app and use Facebook Login for Business. [to verify the current use-case labels]
Where: https://developers.facebook.com/apps/
Add Facebook Login and set redirect URIs and domains
Add the Facebook Login product, open Settings, enter every Valid OAuth Redirect URI, and if you use the JavaScript SDK switch on Login with JavaScript SDK and add your domain to Allowed Domains.
If something goes wrong (1)
- "URL blocked" or redirect URI not whitelisted error at login: Add the exact callback URL (scheme, host, path) to Valid OAuth Redirect URIs; the login page must be https. [2]
Where: https://developers.facebook.com/apps/
Fill in App settings > Basic
Add privacy policy URL, data deletion callback or instructions URL, app domain, category and icon. Copy the App ID; the App Secret stays secret.
verapli captures
FACEBOOK_CLIENT_SECREThere by plain code: encrypted in your browser, never shown to AI.Where: https://developers.facebook.com/apps/
Create a Facebook Login for Business configurationoptional
Business apps only. Create a configuration choosing token type (user or system user), assets and permissions; copy its configuration ID. The authorization code is exchanged server-side for a BISU token.
Test with people who have a role on the app
Admins, developers and testers on the app can grant any permission without approval, so test the whole flow before review.
App Review for any permission beyond public_profile and emailoptional
Skip if you only need sign-in with name and email. Otherwise request Advanced Access per permission with a screencast and test instructions. See meta/app-review.
- The provider says
- Not stated on the App Review overview [to verify] [7]
If something goes wrong (1)
- Whole submission rejected: Reviewers must be able to reach and test the app; provide working test access and instructions. [7]
Switch the app to Live mode
Until Live, only people with a role on the app can log in. Consumer apps must be Live before asking non-role users for Advanced Access permissions; switch email and public_profile to Advanced Access.
If something goes wrong (1)
- Other people cannot log in or email comes back empty: Switch the app to Live and make sure email and public_profile are set to Advanced Access. [6]
Where: https://developers.facebook.com/apps/
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Data deletion and privacy policy are mandatory
Apps that access user data must keep a privacy policy, delete Platform Data on request, and give users a deletion route (callback or instructions URL). Breaches can lead to app suspension or removal. [10]
Data access lapses after 90 days of inactivity
Even while login still works, access to a user's data expires 90 days after they were last active; the app must prompt them to reauthorize. [4]
Annual Data Use Checkup
Apps with Advanced Access must recertify their data use every year or lose access to those features. [9]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
FACEBOOK_CLIENT_ID | not secret | 1234567890123456 | Meta App ID, used as the OAuth client id |
FACEBOOK_CLIENT_SECRET | secret | 32 hex characters | Meta App Secret, used as the OAuth client secret (server-side only) |
FACEBOOK_LOGIN_CONFIG_ID | not secret | 123456789012345 | Facebook Login for Business configuration ID (Business apps only) |
For agents
The same entry as JSON: /api/v1/entries/meta/facebook-login · requirements /api/v1/requirements/meta/facebook-login · terms /api/v1/terms/meta/facebook-login.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Facebook Login, and how long will it take?"
→ tools/call requirements { "provider_id": "meta/facebook-login" }Sources
- Facebook Login – Overview Login for iOS, Android, web, desktop and devices; public_profile and email can be asked of anyone without review; any other permission needs review; people with a role on the app can grant any permission without approval; apps must offer data deletion (contact email or callback) · accessed 25 October 2026 · official
- Facebook Login for the Web with the JavaScript SDK Valid OAuth Redirect URIs, Login with JavaScript SDK toggle, Allowed Domains for JavaScript SDK; only https pages supported for authentication actions · accessed 25 October 2026 · official
- Facebook Login – Access tokens Short-lived tokens about 1-2 hours, long-lived about 60 days, exchange needs the app secret server-side; lifetimes may change without warning · accessed 25 October 2026 · official
- Facebook Login – Authentication versus data access Data access expires 90 days after the user was last active; app must ask the user to reauthorize (reauthorizeDataAccess / auth_type reauthorize) · accessed 25 October 2026 · official
- Facebook Login for Business Configurations created in the App Dashboard; logins only from web surfaces; app must belong to a business portfolio you control, separate from the client's; code exchanged server-side for a business integration system user (BISU) token · accessed 25 October 2026 · official
- Graph API – Access levels Standard vs Advanced Access; Business apps auto-approved for Standard Access; new Consumer apps get Advanced Access to email and public_profile but must switch it on, and must be Live first; Advanced Access may need a verified business; Data Use Checkup for Advanced Access · accessed 25 October 2026 · official
- App Review overview Apps used by people without a role need App Review; if Meta cannot access the app to test it the entire submission is rejected; untestable functionality is not approved · accessed 25 October 2026 · official
- Data deletion request callback Apps that access user data must offer deletion; privacy policy must say how; either a Data Deletion Request URL (HTTPS callback returning url and confirmation_code) or an instructions URL · accessed 25 October 2026 · official
- Meta for Developers blog – Data Use Checkup rolling out broadly Annual Data Use Checkup; missing the deadline loses access to the relevant platform features · accessed 25 October 2026 · official
- Meta Platform Terms No selling or licensing Platform Data (3.a.iv); privacy policy (4.a); delete data on request (3.d); protect app secrets and tokens (6.a.iv); enforcement incl. permanent removal (7.e) · accessed 25 October 2026 · official
- Discourse Meta – Facebook login fails because access token is invalidated after 90 days Developers seeing "The access token is invalid since the user hasn't engaged the app in longer than 90 days" · accessed 25 October 2026 · community
Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Meta is not affiliated with verapli.