Meta API permissions setup guide

① One Meta App covers all three platforms

API permissions for your FB Page, IG and Threads all hang off the same Meta App. Pick one app and keep adding products to it, no need to keep creating new ones.

② There are three kinds of token, with very different lifespans

A short-lived token lasts about 1 to 2 hours, a long-lived one 60 days, and a Facebook Page token can be permanent. For real auto-posting, use the 60 day long-lived one and set up auto-refresh.

③ Why build an app and get a token? (what this whole thing is for)

Think of a Meta App as a permission request form between you and Meta, plus one restricted key. Meta does not hand you an account password, it issues a token that can only do specific things. That way it knows who is using which permission, and it can revoke access at any time.
Meta opens this up because third-party tools make businesses stickier, post more content and buy more ads. That is why this is the official channel for automation that stays within the rules.

④ Development mode vs app review, what is the difference?

Development mode (the app default) : no review, works right away, but it can only touch your own account plus the testers you add. Posting to your own accounts, or serving a handful of clients, is this mode.
App review (Advanced Access) : needed only when the general public should be able to use your app. Meta reviews your use case, asks for a screen recording, and may want business verification.
In one line: development mode plays with your own accounts and skips review, app review plays with everyone's accounts and has to pass. For your own use, or setting up a client, development mode is enough.

Go to developers.facebook.com/apps/ → Create app, fill in the name and contact email, pick a use case (for managing an FB Page pick managing all Page content, for IG or Threads only you can pick Other for now). Once it is built, go to Settings → Basic and note down the App ID and App Secret.

Use Graph API Explorer to pick the app, tick the permissions and generate a short-lived token, then run the line below to exchange it for the 60 day version (swap the uppercase placeholders for your own values):

Publishing to Instagram takes two calls

First switch IG to a business or creator account and add the Instagram product. To publish: create the container, then publish it.

Threads has its own API (graph.threads.net) and its own App ID. In the app, add the Access the Threads API use case and tick the permissions (threads_basic, threads_content_publish, threads_manage_replies…), then fill in the redirect URL under Settings. Getting a token goes through OAuth:

60 days and it expires. Run a schedule that refreshes about every 50 days and the token stays valid.

Is auto-posting to IG and Threads through the API allowed?

Yes. Getting a token through the official Graph API with a proper OAuth flow and posting automatically is allowed. What to avoid is unofficial scrapers and grey-area plugins, which do break the terms.

How do I apply for the Instagram API?

Switch IG to a business or creator account, create a Meta App, add the Instagram product, then generate a token with Graph API Explorer or Instagram Login. Your own account only needs development mode, no app review.

Do tokens expire?

Short-lived is about 1 to 2 hours, long-lived 60 days. Set a schedule to refresh about every 50 days and it keeps working. An FB Page token can be permanent.

Can I set up Threads without my own domain?

Yes. The redirect URL only receives the authorization code, it does not have to be a working site. With no domain, generate an HTTPS address free on Vercel / Netlify / GitHub Pages. If you only post to your own account, use the dashboard token generator and skip the redirect.

I tried this before and have a pile of old apps, should I delete them?

No need. One app covers all three platforms, so pick an existing one and carry on. If it is a mess, create a brand new one with a clear name and leave the old ones alone, they will not interfere.