How to Get a Facebook Graph API Access Token (User, Page, App)

November 9, 2026

Short answer

To get a Facebook Graph API access token, create an app in Meta for Developers, open the Graph API Explorer, pick your app, choose User or Page token, add permissions and click Get Access Token. That token is short-lived, about one to two hours, so exchange it on your server with fb_exchange_token for a long-lived user token of about 60 days, then call /me/accounts with it to get Page tokens that have no expiration date.

A Facebook Graph API access token tells Meta which app is calling and, for most calls, which person or Page it acts for. There are several kinds, and using the wrong one is the most common reason a call fails. This guide covers each kind, how to get it, how long it lasts and how to check it. For what the API costs and what it no longer exposes, see Is the Facebook API free?

Facebook access token types

Token	Represents	How you get it	Lifetime
User access token	A person who logged in to your app	Facebook Login or Graph API Explorer	Short-lived about 1 to 2 hours; long-lived about 60 days
Page access token	A Page, for one admin and one app	`/{user-id}/accounts` with a user token	From a long-lived user token: no expiration date
App access token	Your app itself	`client_credentials`, or `app_id\|app_secret`	Until the secret changes
System user token	A business's server account	Business settings > System Users > Generate token	You choose when generating
Client token	Your app in mobile or desktop code	Settings > Advanced > Security	Not secret; limited use

Lifetimes are from Meta's access token guide, which adds that they may change without warning.

Step 1: create a Meta app

Register as a Meta developer, then start at developers.facebook.com/apps/creation.
App details: name and contact email, then Next.
Use cases: pick the one that matches your goal, or Other, then Next.
Business: pick a business portfolio, or "I don't want to connect a business portfolio yet".
Review requirements and the overview, then Go to dashboard (create an app).

Step 2: get a token in the Graph API Explorer

You need an admin, developer or tester role on the app (Explorer guide).

Open Tools > Graph API Explorer.
In the Meta App dropdown, choose your app.
In the User or Page dropdown, choose User Token (or a Page).
In Permissions, add only what you need, for example pages_show_list and pages_read_engagement for your own Pages.
Click Get Access Token and approve the dialog. The token appears at the top right; the info icon shows its app and permissions.
Run me?fields=id,name and click Submit to test it. Get Code gives you the same request in curl or other languages.

Step 3: exchange for a long-lived access token

Do this on your server, because it uses your app secret (long-lived tokens). An expired token cannot be exchanged.

curl "https://graph.facebook.com/v26.0/oauth/access_token?grant_type=fb_exchange_token&client_id=APP_ID&client_secret=APP_SECRET&fb_exchange_token=SHORT_TOKEN"

The answer includes an expires_in near 5,184,000 seconds, about 60 days. v26.0 is the newest version with a release date in Meta's version changelog today; use the newest one when you read this.

Step 4: get a Page access token that does not expire

curl "https://graph.facebook.com/v26.0/me/accounts?access_token=LONG_LIVED_USER_TOKEN"

Each Page you have a role on comes back with its own access_token. Meta says long-lived Page tokens have no expiration date. They still stop working if the person changes their password, loses their Page role or removes your app. There is no refresh token in Facebook Login: you exchange or re-login instead.

Watch one more clock: data access expires 90 days after the user was last active in your app, even if the token is valid, and the user must re-authorize (data access expiration).

Facebook app access token

curl "https://graph.facebook.com/oauth/access_token?client_id=APP_ID&client_secret=APP_SECRET&grant_type=client_credentials"

You can also pass APP_ID|APP_SECRET directly as access_token. Use app tokens only on servers. They are what you need for debug_token, below.

Check a token with debug_token (Python)

This script exchanges a token, lists your Pages and prints when each token expires. It also signs calls with appsecret_proof, an HMAC-SHA256 of the token keyed with your app secret, which Meta recommends for server calls (securing requests).

import hashlib, hmac, os
import requests

APP_ID, SECRET = os.environ["FB_APP_ID"], os.environ["FB_APP_SECRET"]
G = "https://graph.facebook.com/v26.0"

def proof(token):
    return hmac.new(SECRET.encode(), token.encode(), hashlib.sha256).hexdigest()

def long_lived(short):
    r = requests.get(f"{G}/oauth/access_token", params={
        "grant_type": "fb_exchange_token", "client_id": APP_ID,
        "client_secret": SECRET, "fb_exchange_token": short}, timeout=30)
    r.raise_for_status()
    return r.json()["access_token"]

def debug(token):
    r = requests.get(f"{G}/debug_token", params={
        "input_token": token, "access_token": f"{APP_ID}|{SECRET}"}, timeout=30)
    d = r.json()["data"]
    return d["is_valid"], d.get("expires_at"), d.get("scopes")

user = long_lived(os.environ["FB_SHORT_TOKEN"])
print("user", debug(user))
pages = requests.get(f"{G}/me/accounts", timeout=30, params={
    "access_token": user, "appsecret_proof": proof(user)}).json()["data"]
for p in pages:
    print(p["name"], debug(p["access_token"]))  # expires_at 0 means no expiry

debug_token returns is_valid, expires_at, data_access_expires_at, scopes and user_id (debug_token reference).

Standard Access, Advanced Access and App Review

	Standard Access	Advanced Access
Who the app works for	People with a role on the app	Anyone
App Review	Not needed	Needed for each permission
Business Verification	Not needed	Required

From Meta's access levels page. For App Review, Meta asks for at least one successful call per permission in the 30 days before you submit, a screen recording for each permission, and a privacy policy; decisions usually come within a week (submission guide). Business Verification starts at Settings > Basic > Verification (Business Verification). Reading public data on Pages you do not manage needs the Page Public Content Access feature, which also goes through review (Page reference).

Common Facebook token errors

Code	Meaning	Fix
190	Token expired or invalid; subcode 463 expired, 460 password changed, 458 app removed, 467 invalid	Log the user in again; exchange earlier next time
102	Session expired, revoked or invalid	Same as 190
10, 200 to 299	Permission missing or denied	Add the permission; in live mode it needs Advanced Access
4	App rate limit	Read `X-App-Usage` and slow down
17	User rate limit	Spread calls for that user
32	Pages API limit with a user token	Use a Page token
613	Custom rate limit	Back off
80001	Page business use case limit	Wait `estimated_time_to_regain_access` minutes

Codes from Meta's error handling and rate limiting pages. The app-level limit is calls per hour = 200 times the number of users.

If you just need public data

If you came here to read public Pages, posts or comments of accounts you do not manage, the token path ends at App Review for Page Public Content Access. ScrapeIO reads public Facebook data with one key: the Facebook profile API, profile posts API, comments API and the Ad Library search API, at 1 credit a call. See Facebook Page and profile scrapers and the Facebook MCP server.

curl "https://scrapeio.com/v1/facebook/profile?url=https://www.facebook.com/nike" \
  -H "x-api-key: YOUR_KEY"

FAQ

How long does a Facebook access token last?

Short-lived user tokens last about one to two hours and long-lived ones about 60 days. Page tokens from a long-lived user token have no expiration date.

How do I get a Facebook Page access token that never expires?

Exchange a user token for a long-lived one, then call /me/accounts. For servers, a system user token from Business settings is the sturdier option.

Does Facebook have refresh tokens?

Not in the OAuth sense. You exchange a valid token with fb_exchange_token or send the user through login again.

What is the Facebook app access token format?

APP_ID|APP_SECRET, or the token returned by the client_credentials call. Keep it on the server.

Why does my token work in the Explorer but not in my app?

Usually a permission has only Standard Access, so it works for you as a developer but not for other users, or the token is for a different app than your code.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

100 free credits, no card. Credits never expire.

Get API key