A Page access token is a unique key that allows you to manage and access Facebook Pages programmatically. It grants an app or service access to post content, view analytics, and manage settings on behalf of a Facebook Page.
Why do you need a Page access token?
Without a Page access token, an app or service has no permissions to access or post content to a Facebook Page. The token acts as an authentication key.
Some common uses for Page access tokens include:
- Allowing a social media management platform to publish posts, respond to comments, view insights etc for a Facebook Page.
- Letting an analytics service pull data from a Page to monitor performance.
- Enabling an automated bot or chatbot to respond to users and messages as a Page.
- Integrating a Facebook Page with a marketing automation platform.
In summary, the Page access token grants the necessary access for apps and services to automate actions and access data on behalf of a Page.
How do you get a Page access token?
There are two main methods to get a Page access token:
1. Using the Graph API Explorer
The easiest way to get a Page access token is to use Facebook’s Graph API Explorer tool. This generates a short-lived token that lasts 1-2 hours.
To get a token via the Explorer:
- Go to Graph API Explorer
- Click on “Get User Access Token” in the top right and select your Facebook app.
- From the “Get Token” dropdown, select “Get Page Access Token”
- In the box, select your Facebook Page from the dropdown list.
- Check the permissions your app needs e.g. manage_pages, publish_pages etc.
- Click “Get Access Token”. This will display the Page access token.
This generates a short-lived token that lasts for 1-2 hours. Useful for testing the Graph API.
2. Using an App Access Token
For a longer-lasting Page access token, apps need to exchange an app access token for a Page access token via the Graph API.
To get a Page access token via an app:
- Generate an app access token for your app
- Make a POST request to /{page-id}?fields=access_token with the following parameters
- appsecret_proof – Hashed value of your app secret
- access_token – Your app access token
- This returns a Page access token (with deeper permissions based on the app token)
- Handle this token securely as it has long-term validity
Apps can generate 60-day Page access tokens using this method.
Types of Page Access Tokens
Facebook categorizes Page access tokens based on their longevity and granted permissions:
User Short-Lived Tokens
- Last for 1-2 hours
- Created via Graph API Explorer using a user access token
- Have basic read permissions only
- Used for simple API testing
App Short-Lived Tokens
- Last for 1-2 hours
- Generated via an app token using the token endpoint
- Can request extended Page permissions beyond read
- Used for short-term operations requiring deeper access
App Long-Lived Tokens
- Last for 60 days
- Created by apps exchanging an app token for a Page token
- Used for long-term Page management and automation
Apps need to handle short-lived and long-lived tokens appropriately based on their purpose.
How to extend Page access token expiry?
By default Page access tokens expire after a short period:
- User tokens last 1-2 hours
- App short-lived tokens last 1-2 hours
To receive a token with a longer validity period:
- Apps can generate a 60-day Page token by exchanging an app token for a Page token
- Before the 60-day Page token expires, the app should generate a new long-lived token
- Store the new Page token to use once the old token expires
- Repeat this process as needed to extend Page token validity
Apps should listen for expiration timestamp in the Page access token metadata to understand when a new token is needed.
Permissions granted by Page access tokens
Page access tokens grant permissions to perform actions on behalf of a Facebook Page. The permissions depend on:
- Type of access token – user vs app token
- Whether Basic or Extended Page permissions were requested
Basic permissions
With Basic access, Page access tokens can:
- Read Page mailboxes, conversations, posts etc
- View Page Insights and analytics data
- Cannot publish content or manage settings
Extended permissions
With Extended Page access, tokens can also:
- Publish and delete posts on behalf of a Page
- Respond to and delete comments
- Send messages as the Page
- Create ads and view billing information
- Update Page profile information
- Manage admin roles and ownership
Apps request either Basic or Extended permissions based on the level of access the app requires.
Best practices when using Page access tokens
Some best practices for handling Page access tokens include:
- Store tokens securely – Avoid exposing access tokens in code or logs. Use a secure vault.
- Limit permission scope – Only request necessary permissions for your app’s use case.
- Rotate long-lived tokens – Replace long-lived tokens before they expire to avoid disruptions.
- Handle errors gracefully – Check for expired tokens and request new ones if needed.
- Revoke unnecessary tokens – Revoke Page tokens your app no longer needs access to.
- Validate token expiry – Check expiry time of tokens to preemptively refresh.
Following these practices helps securely manage Page access tokens and account permissions.
Revoking Page Access Tokens
If at any time you need to revoke access granted via a Page access token, you can do so in two ways:
Via App Dashboard
- Go to App Dashboard > Settings
- Under “Authorized Apps” find the app
- Click “Revoke Access” to remove the app’s access
Via API call
Make a DELETE call to the API endpoint:
/{user-id}/permissions
This revokes all access tokens for the app for that user. The next time the app tries to generate a Page token, it will need to re-authenticate.
Troubleshooting Page Access Tokens
Some common issues faced when using Page access tokens include:
Token expired error
- Short-lived tokens last 1-2 hours, so may expire if usage exceeds validity period
- Apps should listen for expiry timestamp and proactively generate fresh tokens
Permission denied errors
- App likely does not have necessary permissions
- When exchanging token, ensure proper permissions are requested
- Consider requesting Extended Page Permissions
App not making requests
- Double check token being used corresponds to app and Page
- Ensure token correctly stored and passed in API requests
- Test with Postman to isolate issue
Debugging token issues requires verifying the token validity, permissions and scope. Refer to Facebook’s user access and Page access token docs for additional troubleshooting.
Conclusion
In summary:
- Page access tokens allow apps to manage Pages via the Graph API
- Tokens can be short-lived (1-2 hours) or long-lived (60 days)
- Permissions granted depend on whether Basic or Extended access requested
- Apps should handle tokens securely and rotate before expiry
Understanding how to properly generate, store and refresh Page access tokens is key to managing Facebook Pages programmatically.