VerifiedResearched 2026-10-28Confidence high

Meta (Facebook, Instagram, WhatsApp)

Meta Platforms · developers.facebook.com · Developer portal

Tier 3 · Review requiredCustomer-side gate

Users without an app role can grant a permission only after it gets Advanced Access. That needs App Review per permission plus Business Verification. Plan for 1 to 8 weeks of waiting.

sourced

inferred

Customer-side gate: The connecting user needs a task on the Page or admin rights on their business portfolio. For WhatsApp, the client's admin runs Embedded Signup and adds a payment method.

App types (3)

Use case: Manage everything on your Page (Facebook Login for Business): Users connect Facebook Pages and linked Instagram accounts. Adds pages_show_list and business_management.
Use case: Instagram API with Instagram Login: Instagram business or creator accounts without a Page. Uses instagram_business_* on graph.instagram.com.
Use case: WhatsApp, onboarded as a Tech Provider: Users connect WhatsApp Business accounts through Embedded Signup.

Docs read(reached)
Endpoints probed(reached)
Portal checked(reached)
Set up by a person(not reached)

Evidence: 0 tested, 2 probed, 33 sourced, 3 inferred

Generate a live guide to compare with this one.

Next step

Create the Meta app You20 to 40 min

At developers.facebook.com/apps, click Create App. Pick use cases: Manage everything on your Page, Instagram API, and/or WhatsApp. Connect a business portfolio.

https://developers.facebook.com/apps/

0 of 13

What does your agent need?

Select everything it does. Scopes decide the tier.

3Your tier: Review requiredThe provider must approve the app before users outside your test list can connect.

Start today

Composio-managed OAuth: Yes

sourced

Composio provides managed OAuth for Facebook, Instagram, and WhatsApp. Users see Composio's app on the consent screen, and you share its rate limits and scopes. After you switch to your own auth config, existing users keep their connection until they re-authenticate, or until you import their credentials where Composio supports it.

Time and effort

You can build while you wait.

Stage	Who can connect	Hands-on	Waiting	Review
Prototype	Only people with an app role (admin, developer, tester). sourced With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review. Access Levels sourced · official docs · 2026-10-28 sourced Apps are created by choosing use cases. Use cases cannot be removed later and some are incompatible. Apps that access data you do not own must connect a business portfolio. The Page use case adds business_management and pages_show_list. Create an App sourced · official docs · 2026-10-28	2 h to 6 h	none	No
Limited beta	Design partners you add as testers in App Roles. sourced With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review. Access Levels sourced · official docs · 2026-10-28 sourced Apps used by anyone without a role on the app, or a role in a Business that has claimed the app, must pass App Review. If reviewers cannot access the app, the entire submission is rejected. App Review sourced · official docs · 2026-10-28 sourced You cannot onboard WhatsApp customers through Embedded Signup until each required permission has Advanced Access. The default limit is 10 new business customers per rolling 7 days. The page says it rises to 200 automatically after Business Verification, App Review, and Access Verification. Above 200 you must apply to be a Meta Business Partner. Embedded Signup sourced · official docs · 2026-10-28	1 h to 3 h	0 to 2 days	No
Production	Any Page admin, Instagram professional account, or WhatsApp business, for Advanced Access permissions. sourced Meta says you should receive an App Review decision within a week of submitting. App Review submission guide Quote: "should receive a decision within a week". sourced · official docs · 2026-10-28 sourced Business verification is required to complete App Review (since 2023). Data handling questions are required for Advanced Access from June 12, 2023. App settings need an icon, privacy policy URL, category, business email, and platforms. App Review: content sourced · official docs · 2026-10-28 sourced A WhatsApp partner reports Meta reviews business verification within up to 14 business days. Documents must match Business Info, the website must show the same name, address, and phone, and the verification email must be on the website's domain. 360dialog: Classic Business Verification sourced · community · 2026-10-28 sourced A developer on Meta's forum reported in early June 2026 that the dashboard said most requests are reviewed within 10 days, and their request was still pending after 13 days with no update. App Review pending for 13 days sourced · community · 2026-10-28 inferred Realistic time to production is about 1 to 8 weeks: business verification (up to about 3 weeks), then App Review (a week or more), plus a cycle per rejection. Sequential because business verification must finish before review can complete (e10, e18). Uses e7, e30, e31. Rejection cycles are not measured by any source we opened. inferred · reasoning · 2026-10-28 sourced You cannot onboard WhatsApp customers through Embedded Signup until each required permission has Advanced Access. The default limit is 10 new business customers per rolling 7 days. The page says it rises to 200 automatically after Business Verification, App Review, and Access Verification. Above 200 you must apply to be a Meta Business Partner. Embedded Signup sourced · official docs · 2026-10-28	12 h to 30 h	Provider says: 1 to 7 daysDevelopers report: 7 to 56 days	Yes

Prototype: Standard Access is automatic. Use your own test Page, Instagram professional account, or WhatsApp test number.
Limited beta: Each beta user must accept a role invite. The tester limit is unconfirmed. A WhatsApp beta covers only numbers you own until you get Advanced Access.
Production: Meta says App Review takes about a week. A forum report shows a 10 day estimate. A WhatsApp partner reports up to 14 business days for business verification. Each rejection adds a cycle.

Scopes

Scopes that match your selection are marked.

Log in onlyNo review · Read data
public_profile
public_profile is granted to every app and identifies the user only. email needs Advanced Access.
sourced
With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review.
Access Levels
sourced · official docs · 2026-10-28
sourced
public_profile is automatically granted to all apps. The email permission's review entry points to App Review and does not say it is automatic.
Permissions Reference
sourced · official docs · 2026-10-28
Read Facebook PagesReview · Read data, Act while offline
pages_show_list pages_read_engagement
Needs App Review and Business Verification. Long-lived Page tokens do not expire, which fits background agents.
sourced
pages_read_engagement depends on pages_show_list. Review asks why you need this data for Pages you do not own and for a screencast showing Page content in your app.
Permissions Reference
sourced · official docs · 2026-10-28
sourced
With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review.
Access Levels
sourced · official docs · 2026-10-28
sourced
Short-lived tokens expire in hours. Long-lived user tokens last about 60 days and are exchanged on your server with the app secret. Long-lived Page tokens have no expiry date. An expired token cannot be exchanged; the user must log in again.
Get Long-Lived Tokens
sourced · official docs · 2026-10-28
Post and message as a PageReview · Write data, Act while offline
pages_manage_posts pages_messaging pages_manage_metadata
One screencast per permission. pages_manage_posts depends on the read permissions, so submit those too.
sourced
pages_read_engagement depends on pages_show_list. Review asks why you need this data for Pages you do not own and for a screencast showing Page content in your app.
Permissions Reference
sourced · official docs · 2026-10-28
sourced
Each permission or feature needs its own screen recording showing a user granting it and how the app uses it: at least 1080p, monitor width 1440 or less, English UI if possible, captions where the UI is not self-explanatory, no audio.
App Review submission guide
sourced · official docs · 2026-10-28
Instagram professional accountsReview · Read data, Write data
instagram_business_basic instagram_business_manage_messages instagram_business_content_publish instagram_business_manage_comments
Needs App Review and Business Verification. Personal accounts cannot connect.
sourced
Instagram API with Instagram Login works with professional (business or creator) accounts and needs no Facebook Page. The Facebook Login path needs a professional account linked to a Page. Advanced Access needs App Review and Business Verification.
Instagram Platform overview
sourced · official docs · 2026-10-28
sourced
instagram_business_manage_messages depends on instagram_business_basic. Review asks you to show sending a message and a cURL request.
Permissions Reference
sourced · official docs · 2026-10-28
sourced
Instagram Basic Display API stopped working on December 4, 2024, announced September 4, 2024. After that there is no Instagram API for consumer apps.
Update on Instagram Basic Display API
sourced · official forum or blog · 2026-10-28
WhatsApp messaging for clientsReview · Read data, Write data, Act while offline
whatsapp_business_messaging whatsapp_business_management
Business verification, then App Review with two videos. Limit: 10 new clients a week, 200 after verification and review. More needs Meta Business Partner status.
sourced
WhatsApp Tech Provider onboarding: business verification must finish before App Review starts. App Review needs two videos (a message sent from your app and received in WhatsApp, and a template being created) and Advanced Access to whatsapp_business_messaging and whatsapp_business_management.
Get started for Tech Providers
sourced · official docs · 2026-10-28
sourced
Without whatsapp_business_management, calls on WhatsApp accounts your business does not own return error code 200. Clients must add their own payment method.
Get started for Tech Providers
sourced · official docs · 2026-10-28
sourced
You cannot onboard WhatsApp customers through Embedded Signup until each required permission has Advanced Access. The default limit is 10 new business customers per rolling 7 days. The page says it rises to 200 automatically after Business Verification, App Review, and Access Verification. Above 200 you must apply to be a Meta Business Partner.
Embedded Signup
sourced · official docs · 2026-10-28
sourced
The Access Verification page now says it is no longer required and keeps the process only as legacy reference.
Access Verification
sourced · official docs · 2026-10-28
sourced
Meta retired Access Verification for apps that access business data, in a developer blog post dated October 9, 2026. Developers no longer wait on a separate access review before going live.
Social Media Today: Meta removes access verification for developers
Secondary report of Meta's post. It does not mention the Embedded Signup limit.
sourced · community · 2026-10-28
Business portfolio assetsReview · Admin-level
business_management
Reads and writes Business Manager assets. Needs App Review. The Page use case adds it by default.
sourced
Apps are created by choosing use cases. Use cases cannot be removed later and some are incompatible. Apps that access data you do not own must connect a business portfolio. The Page use case adds business_management and pages_show_list.
Create an App
sourced · official docs · 2026-10-28
sourced
pages_read_engagement depends on pages_show_list. Review asks why you need this data for Pages you do not own and for a screencast showing Page content in your app.
Permissions Reference
sourced · official docs · 2026-10-28

Requirements

Steps

Prototype

Create the Meta appYou20 to 40 min
At developers.facebook.com/apps, click Create App. Pick use cases: Manage everything on your Page, Instagram API, and/or WhatsApp. Connect a business portfolio.
https://developers.facebook.com/apps/
sourced
Apps are created by choosing use cases. Use cases cannot be removed later and some are incompatible. Apps that access data you do not own must connect a business portfolio. The Page use case adds business_management and pages_show_list.
Create an App
sourced · official docs · 2026-10-28
probed
Developer portal at developers.facebook.com/apps responds with HTTP 200 and a JavaScript page shell. The app list is not in the HTML, so it renders only for a signed-in developer.
Probe: developer portal
Two GETs: HTTP 200 without redirect; body 143 KB JavaScript shell, no app list.
probed · probe · 2026-10-28
Start Business VerificationYou1 to 2 hours
It takes longest and blocks review. A Business Admin starts it from verification settings or Security Center. See the checklist below.
https://developers.facebook.com/docs/development/release/business-verification
sourced
Business Verification is needed if your app requests Advanced Access or lets other businesses access their own data. Only an Admin of the Business can complete it. Apps used only by people with app roles do not need it.
Business Verification
sourced · official docs · 2026-10-28
sourced
Business verification is required to complete App Review (since 2023). Data handling questions are required for Advanced Access from June 12, 2023. App settings need an icon, privacy policy URL, category, business email, and platforms.
App Review: content
sourced · official docs · 2026-10-28
Add your redirect URIYou15 min
In Facebook Login settings, add your HTTPS callback under Valid OAuth redirect URIs. Use exactly that value in the authorize request and code exchange.
sourced
Valid OAuth redirect URIs are set in the App Dashboard under Facebook Login > Settings > Client OAuth Settings. The redirect_uri in the code exchange must be the same as the one used to start login. The manual flow page does not mention PKCE.
Manually Build a Login Flow
sourced · official docs · 2026-10-28
Build the connect flowAgent2 to 4 hours
Redirect to www.facebook.com/v26.0/dialog/oauth with client_id, redirect_uri, state, and scope. Exchange the code for a long-lived user token (about 60 days) and fetch long-lived Page tokens. There are no refresh tokens.
sourced
Short-lived tokens expire in hours. Long-lived user tokens last about 60 days and are exchanged on your server with the app secret. Long-lived Page tokens have no expiry date. An expired token cannot be exchanged; the user must log in again.
Get Long-Lived Tokens
sourced · official docs · 2026-10-28
sourced
The latest Graph API version is v26.0, released July 29, 2026.
Graph API Changelog
sourced · official docs · 2026-10-28
probed
The Facebook Login authorization dialog at www.facebook.com/v26.0/dialog/oauth is live and shows an "Invalid app ID" error page for an unknown client_id instead of redirecting.
Probe: OAuth dialog
HTTP 200, HTML interstitial with header 'Invalid app ID'. No redirect to example.com.
probed · probe · 2026-10-28
Call every permission onceAgent30 to 60 min
Make one successful call per permission, or use the Graph API Explorer. Meta needs it logged within 30 days of submitting. Logging takes up to 2 days.
sourced
You must make at least one successful API call for each permission you request, within 30 days of submitting. The request button stays grayed out until a call is logged, which can take up to 2 days. The Graph API Explorer counts.
App Review submission guide
sourced · official docs · 2026-10-28

Limited beta

Add beta users as testersYou10 min per user
In App Roles, add each design partner as a tester. After they accept, they can connect without review.
sourced
With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review.
Access Levels
sourced · official docs · 2026-10-28
sourced
Apps used by anyone without a role on the app, or a role in a Business that has claimed the app, must pass App Review. If reviewers cannot access the app, the entire submission is rejected.
App Review
sourced · official docs · 2026-10-28

Production

Fill App SettingsYou30 to 60 min
In Settings > Basic, add the icon, privacy policy URL, data deletion URL or callback, category, contact email, and platforms.
sourced
Business verification is required to complete App Review (since 2023). Data handling questions are required for Advanced Access from June 12, 2023. App settings need an icon, privacy policy URL, category, business email, and platforms.
App Review: content
sourced · official docs · 2026-10-28
sourced
Apps that access user data must give either a data deletion instructions URL or a data deletion callback URL in Basic Settings. A callback must use HTTPS.
Data Deletion Callback
sourced · official docs · 2026-10-28
sourced
Data handling questions appear only after business verification is approved. Answers are evaluated right away, which can take up to 30 seconds. The app icon must be 1024x1024 and contain no Meta trademarks or logos.
App Review submission guide
sourced · official docs · 2026-10-28
Answer data handling questionsYou30 min
Meta asks how you process, share, and protect data. Answers are checked right away.
sourced
Business verification is required to complete App Review (since 2023). Data handling questions are required for Advanced Access from June 12, 2023. App settings need an icon, privacy policy URL, category, business email, and platforms.
App Review: content
sourced · official docs · 2026-10-28
sourced
Data handling questions appear only after business verification is approved. Answers are evaluated right away, which can take up to 30 seconds. The app icon must be 1024x1024 and contain no Meta trademarks or logos.
App Review submission guide
sourced · official docs · 2026-10-28
Record one screencast per permissionYou2 to 6 hours
Show the grant and your app using it. 1080p or higher, width 1440 or less, English UI, no audio, large cursor, captions.
sourced
Each permission or feature needs its own screen recording showing a user granting it and how the app uses it: at least 1080p, monitor width 1440 or less, English UI if possible, captions where the UI is not self-explanatory, no audio.
App Review submission guide
sourced · official docs · 2026-10-28
sourced
pages_read_engagement depends on pages_show_list. Review asks why you need this data for Pages you do not own and for a screencast showing Page content in your app.
Permissions Reference
sourced · official docs · 2026-10-28
sourced
instagram_business_manage_messages depends on instagram_business_basic. Review asks you to show sending a message and a cURL request.
Permissions Reference
sourced · official docs · 2026-10-28
Submit App ReviewYou1 to 3 hours
Request Advanced Access per permission with a description, reviewer instructions, and recording. Do not switch to Live or change settings during review.
sourced
Reviewers use their own test accounts. The app must be public or you must give access instructions. Do not include your personal Meta credentials.
App Review submission guide
sourced · official docs · 2026-10-28
sourced
Listed problems include copied or vague usage descriptions, missing screen recordings, changing settings after submission, and switching the app to Live mode before review completes.
App Review submission guide
sourced · official docs · 2026-10-28
sourced
You must make at least one successful API call for each permission you request, within 30 days of submitting. The request button stays grayed out until a call is logged, which can take up to 2 days. The Graph API Explorer counts.
App Review submission guide
sourced · official docs · 2026-10-28
Wait for the decisionProvider (wait)1 to 3 weeks per cycle
If a permission is rejected, fix what the notice names and resubmit.
sourced
Meta says you should receive an App Review decision within a week of submitting.
App Review submission guide
Quote: "should receive a decision within a week".
sourced · official docs · 2026-10-28
sourced
A developer on Meta's forum reported in early June 2026 that the dashboard said most requests are reviewed within 10 days, and their request was still pending after 13 days with no update.
App Review pending for 13 days
sourced · community · 2026-10-28
Onboard as WhatsApp Tech ProviderYou4 to 8 hours
WhatsApp only. In Use cases > Customize > WhatsApp, choose Tech Provider. Submit two videos, set up webhooks, and use Embedded Signup v4.
https://developers.facebook.com/docs/whatsapp/solution-providers/get-started-for-tech-providers
sourced
WhatsApp Tech Provider onboarding: business verification must finish before App Review starts. App Review needs two videos (a message sent from your app and received in WhatsApp, and a template being created) and Advanced Access to whatsapp_business_messaging and whatsapp_business_management.
Get started for Tech Providers
sourced · official docs · 2026-10-28
sourced
You cannot onboard WhatsApp customers through Embedded Signup until each required permission has Advanced Access. The default limit is 10 new business customers per rolling 7 days. The page says it rises to 200 automatically after Business Verification, App Review, and Access Verification. Above 200 you must apply to be a Meta Business Partner.
Embedded Signup
sourced · official docs · 2026-10-28
sourced
Embedded Signup v2 and v3 are deprecated on October 15, 2026. Migrate to v4.
Embedded Signup
sourced · official docs · 2026-10-28
Go LiveYou30 min
Complete the Data Use Checkup, switch to Live, and confirm Advanced Access per permission.
sourced
The Data Use Checkup is an annual review for apps that are live or have Advanced Access. You must complete it before switching an app to Live mode and to keep API access.
Data Use Checkup
sourced · official docs · 2026-10-28
sourced
With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review.
Access Levels
sourced · official docs · 2026-10-28

Blockers

Request advanced access is grayed out.
Cause: Meta has not logged a successful call for that permission in 30 days.
Fix: Make one call, wait up to 2 days, and retry.
sourced
You must make at least one successful API call for each permission you request, within 30 days of submitting. The request button stays grayed out until a call is logged, which can take up to 2 days. The Graph API Explorer counts.
App Review submission guide
sourced · official docs · 2026-10-28
The whole submission is rejected.
Cause: Reviewers could not reach your app or follow your instructions.
Fix: Give a public URL or access steps for the reviewer's test account.
Help: Meta developer support page.
sourced
Apps used by anyone without a role on the app, or a role in a Business that has claimed the app, must pass App Review. If reviewers cannot access the app, the entire submission is rejected.
App Review
sourced · official docs · 2026-10-28
sourced
Reviewers use their own test accounts. The app must be public or you must give access instructions. Do not include your personal Meta credentials.
App Review submission guide
sourced · official docs · 2026-10-28
One permission is rejected.
Cause: Unclear screencast, copied description, or a use outside allowed usage.
Fix: Re-record the grant and use, rewrite the description, and resubmit.
sourced
Each permission or feature needs its own screen recording showing a user granting it and how the app uses it: at least 1080p, monitor width 1440 or less, English UI if possible, captions where the UI is not self-explanatory, no audio.
App Review submission guide
sourced · official docs · 2026-10-28
sourced
Listed problems include copied or vague usage descriptions, missing screen recordings, changing settings after submission, and switching the app to Live mode before review completes.
App Review submission guide
sourced · official docs · 2026-10-28
Real users get missing-permission errors.
Cause: It has only Standard Access, which covers app roles.
Fix: Add them as testers, or get Advanced Access.
sourced
With Standard Access, only people who have a role on your app can grant permissions. Advanced Access lets any user grant them, and each permission must be approved through App Review.
Access Levels
sourced · official docs · 2026-10-28
Business verification is rejected.
Cause: Name, address, or phone does not match Business Info or the website, or the email is off-domain.
Fix: Match all three exactly, use a domain email, and resubmit.
Help: Meta Business Help Center chat.
sourced
A WhatsApp partner reports Meta reviews business verification within up to 14 business days. Documents must match Business Info, the website must show the same name, address, and phone, and the verification email must be on the website's domain.
360dialog: Classic Business Verification
sourced · community · 2026-10-28
WhatsApp calls on a client account fail with error code 200.
Cause: No Advanced Access for whatsapp_business_management.
Fix: Complete Tech Provider App Review for that permission.
sourced
Without whatsapp_business_management, calls on WhatsApp accounts your business does not own return error code 200. Clients must add their own payment method.
Get started for Tech Providers
sourced · official docs · 2026-10-28
Embedded Signup stops onboarding new clients for the week.
Cause: You hit the rolling 7 day limit: 10 by default, 200 after Business Verification and App Review.
Fix: Finish verification and review. Access Verification is retired, so check the limit in WhatsApp Manager. Above 200, apply to be a Meta Business Partner.
sourced
You cannot onboard WhatsApp customers through Embedded Signup until each required permission has Advanced Access. The default limit is 10 new business customers per rolling 7 days. The page says it rises to 200 automatically after Business Verification, App Review, and Access Verification. Above 200 you must apply to be a Meta Business Partner.
Embedded Signup
sourced · official docs · 2026-10-28
sourced
The Access Verification page now says it is no longer required and keeps the process only as legacy reference.
Access Verification
sourced · official docs · 2026-10-28
sourced
Meta retired Access Verification for apps that access business data, in a developer blog post dated October 9, 2026. Developers no longer wait on a separate access review before going live.
Social Media Today: Meta removes access verification for developers
Secondary report of Meta's post. It does not mention the Embedded Signup limit.
sourced · community · 2026-10-28
An Instagram account cannot connect.
Cause: Personal accounts have had no Instagram API since December 4, 2024.
Fix: Ask the user to switch to a business or creator account.
sourced
Instagram Basic Display API stopped working on December 4, 2024, announced September 4, 2024. After that there is no Instagram API for consumer apps.
Update on Instagram Basic Display API
sourced · official forum or blog · 2026-10-28
sourced
Instagram API with Instagram Login works with professional (business or creator) accounts and needs no Facebook Page. The Facebook Login path needs a professional account linked to a Page. Advanced Access needs App Review and Business Verification.
Instagram Platform overview
sourced · official docs · 2026-10-28
The Facebook token stops working after about two months.
Cause: User tokens last about 60 days and cannot be exchanged after expiry.
Fix: Use Page tokens and prompt a reconnect before expiry.
sourced
Short-lived tokens expire in hours. Long-lived user tokens last about 60 days and are exchanged on your server with the app secret. Long-lived Page tokens have no expiry date. An expired token cannot be exchanged; the user must log in again.
Get Long-Lived Tokens
sourced · official docs · 2026-10-28

Agent and you

Agent did

Read about 25 official Meta and Composio pages.
Probed the v26.0 OAuth dialog: a fake client ID shows Invalid app ID.
Checked the developer portal: it requires sign-in.
Drafted a justification, a screencast script, and a verification checklist.

Agent can do

Write the OAuth flow and token storage code.
Make the required API call per permission.
Draft usage descriptions, reviewer instructions, and data handling answers.
Check that your website, Business Info, and documents match.
Fill App Settings in a browser after you sign in.

You must do

Sign in to Meta and create the app.
Run Business Verification as a Business Admin.
Record the screencasts.
Publish a privacy policy and data deletion instructions.
Submit App Review and accept the Platform Terms.
Complete the yearly Data Use Checkup.

Drafts

pages_read_engagement usage description draft · scope justification

DRAFT, edit before use.

[App name] is an AI assistant for small businesses. A Page admin connects their Page so the assistant can summarize posts, comments, and engagement, and suggest replies.

We use pages_read_engagement to read posts, comments, and metadata of connected Pages. We show a daily summary and draft replies the admin approves before posting.

We request pages_show_list so the user can pick a Page.

We do not sell this data or use it for ads. We keep it only while the Page is connected. Users delete it at [data deletion URL].

To test: go to [URL], sign in with [test login steps], click Connect Facebook Page, grant access, and open Daily summary.

App Review screencast for pages_read_engagement draft · demo video script

DRAFT. One recording per permission.

1. (0:00) Caption: "This shows how [App name] uses pages_read_engagement." Show the public home page.
2. (0:10) Sign in with the test account.
3. (0:20) Click Connect Facebook Page. Show the dialog with your app name.
4. (0:35) Log in as a test user who manages a test Page. Click Continue on the permission screen.
5. (0:55) Choose the test Page. Caption: "pages_show_list lets the user pick a Page."
6. (1:10) Open Daily summary. Caption: "Read with pages_read_engagement."
7. (1:30) Approve a drafted reply. Caption that nothing posts without approval.
8. (1:45) Show Settings > Disconnect and data removal.

Repeat for each permission.

Business verification document checklist draft · other

DRAFT. Check Meta's accepted list in the Business Help Center before uploading.

- Legal name: certificate of incorporation, business license, or tax registration in the company's name.
- Address or phone: a recent utility bill or bank statement with the legal name and same address or phone.
- Website: live, HTTPS, with the same legal name, address, and phone as Business Info.
- Email: an address on your domain, or domain verification in Business Settings.
- Business Info: legal name, address, phone, website exactly as on the documents.
- A Business Admin to upload. Partners cannot upload for you.
- No expired documents.

DRAFT.

- Public URL, no login.
- Names your company and contact.
- Lists the Meta data you collect (Page content, Instagram messages, WhatsApp messages) and why.
- Names who you share it with, including your AI model provider.
- States retention.
- Explains deletion requests and links your data deletion URL or describes the callback.
- Matches your data handling answers.

Open questions

How long does App Review take?
Meta says a week. A forum report shows a review open at 13 days.
To resolve: Record your submission dates and add them as tested.
Which documents does Business Verification accept, and how long does it take?
Meta's Help Center page did not render. This list comes from a WhatsApp partner's docs.
To resolve: Compare with the Help Center article while signed in.
Does Access Verification still affect the WhatsApp limit?
Meta says it is retired (October 9, 2026, per a news report), but the Embedded Signup page still lists it.
To resolve: Check WhatsApp Manager after review, or ask Meta developer support.
How long do Instagram Login tokens last, and can they be refreshed?
This run did not read the Instagram token page.
To resolve: Read the Instagram access token docs before building background jobs.
Does Facebook Login support PKCE, and is there a tester limit?
Neither was confirmed.
To resolve: Check the manual flow docs and the App Roles page.
What does Composio's managed WhatsApp auth cover?
The managed table does not list permissions or flows.
To resolve: Check the WhatsApp toolkit page or the composio_managed_auth_schemes field.

Sources

Access Levels official docs · 2026-10-28
Business Verification official docs · 2026-10-28
App Review official docs · 2026-10-28
App Review submission guide official docs · 2026-10-28
App Review: content official docs · 2026-10-28
Data Deletion Callback official docs · 2026-10-28
Data Use Checkup official docs · 2026-10-28
Create an App official docs · 2026-10-28
Instagram Platform overview official docs · 2026-10-28
Update on Instagram Basic Display API official forum or blog · 2026-10-28
Permissions Reference official docs · 2026-10-28
Get started for Tech Providers official docs · 2026-10-28
Embedded Signup official docs · 2026-10-28
Access Verification official docs · 2026-10-28
Get Long-Lived Tokens official docs · 2026-10-28
Graph API Changelog official docs · 2026-10-28
Probe: OAuth dialog probe · 2026-10-28
Probe: developer portal probe · 2026-10-28
Composio managed auth composio docs · 2026-10-28
Composio white-labeling authentication composio docs · 2026-10-28
Composio custom app vs managed app composio docs · 2026-10-28
360dialog: Classic Business Verification community · 2026-10-28
App Review pending for 13 days community · 2026-10-28
Manually Build a Login Flow official docs · 2026-10-28
Social Media Today: Meta removes access verification for developers community · 2026-10-28

Verification changes

Said the WhatsApp onboarding limit starts at 10 a week and reaches 200 after verification and review. Noted that the Embedded Signup page still lists Access Verification, which Meta retired.
The blocker said only '10 (or 200 after review)'. Meta's page names three steps for 200, one of them now retired. Production notes and the WhatsApp tier mentioned only the 200 cap. 2026-10-28
Fixed the date of the forum report on App Review waits.
The request was pending since May 21, 2026 and the post came 13 days later, so early June, not May. 2026-10-28
Added that a logged API call can take up to 2 days to show, and that Graph API Explorer calls count.
The submission guide says both. Without this you may retry too early. 2026-10-28
Made screencast captions conditional and English UI 'if you can'.
The submission guide asks for captions only when the app is not in English or parts are not self-explanatory. 2026-10-28
Removed email from the no-review Log in only tier and said it needs App Review for Advanced Access.
The Permissions Reference says only public_profile is automatic. The email entry points to App Review. 2026-10-28
Upgraded the redirect URI claim from inferred to sourced and named the exact setting.
The manual login flow page names Valid OAuth redirect URIs under Client OAuth Settings and says the exchange must reuse the same redirect_uri. 2026-10-28
Cited the submission guide for 'answers are checked right away' and for the 1024x1024 icon rule.
The App Review content page cited before does not say either. The submission guide does. 2026-10-28
Added that people with a role in a Business that claimed the app also count as having a role.
The App Review page says so. 2026-10-28
Composio note: replaced "When you switch to your own app, only new connections use it; existing users keep the old connection until they reconnect." with the switching rule as Composio states it, including importing credentials.
A reviewer cross-checked Composio's docs: existing users stay on the old connection until they re-authenticate or you import their credentials, so "must reconnect" overstated it. 2026-10-28