Long-Lived Facebook API Token: How to Get and Use It

A long-lived Facebook API token is needed for the stable operation of integrations, automation and services related to Facebook Ads. In this article I will show you how to get a long-lived token, where to use it and what restrictions are important to consider.

And in general, if we send a request to Facebook like the one below, they will answer us in clear English that this token is not intended for long-term work via the API!

https://graph.facebook.com/v20.0/oauth/access_token?grant_type=fb_attenuate_token&client_id=119211728144504&fb_exchange_token=TOKEN

At the same time, if we put the token inAccess Token Debugger, then we will see this picture:

Supposedly the token is eternal, although it was issued a minute ago)

Another problem (which, by the way, didn’t exist before, and which tells us that Facebook is tightening the screws on using the Ads Manager token) is a necessity to use cookies when working with the API! Now, if you send a requestwithout cookiesyou get an errorInvalid request, like this:

{"error" : {"message" : "Invalid request." , "type" : "OAuthException" , "code" : 1, "fbtrace_id" : "AZtzpkeXv5S5tNosPDR4QhT"}, "fb_trace_id" : "GVh7IRyrVAd" , "www_request_id" : "AZtzpkeXv5S5tNosPDR4QhT"}

Using cookies means that when they expire (or when changing a password, logging out, any receipts, etc.), they will need to be updated. And this is also an extra hassle.

Yes, automation services likeDolphin CloudorFbToolNow they know how to pull out a token again when it dies. But there is evidence from people respected in the community that if you mess with a dead token to the API, you will be logged out. And, yes,Dolphin Cloudknows how to log in again using your username-password and EVEN knows how to pass 2FA.

Is it possible to do without all this leapfrog and dancing? Let’s try it.

Disclaimer: Please note that the process described below is much longer than pulling a token from Ads, and if your accounts are flying like seeds, forget it! But for kings on which you simply hang accounts/BMs, but don’t touch the kings themselves — that’s it!

Let’s go.

Application registration

First you need to register as a developer on developers.facebook.com and create an application.

When creating, select: Other

And then type: Business

Setting up access to the Marketing API

After you have entered the name of your new app and are taken to the main dashboard, you need to select what we want to have access to. And that something is the Marketing API.

Next, go to Tools, check all the available boxes there and click Get Token.

After receiving the token, let’s see what its lifespan is:

Those. for 2 whole months we can work with any advertising accounts on this social network, not use any cookies and feel great.

And then, say a week before expiration, we can always update the token either manually,or programmatically.

Also, in my tests, this token did NOT change when accounts were logged out and even survived a password change on one of them.

Where to use?

Unfortunately, now there are no commonly used automation tools likeFbToolAndDolphin CloudThey don’t know how to work with such a token. As an exception, I plan to teach this in my free time.ReMask socket. Also, such tokens function perfectly in the built-intrackerKeitaro integration with febe, created forpulling up to the expense tracker.

In all other cases, I recommend using such tokens in your custom projects and products, and then, you see, someday the market will catch up!