Meta API permissions setup guide

① One Meta App covers all three platforms

API permissions for your FB Page, IG and Threads all hang off the same Meta App. Pick one app and keep adding products to it, no need to keep creating new ones.

② There are three kinds of token, with very different lifespans

A short-lived token lasts about 1 to 2 hours, a long-lived one 60 days, and a Facebook Page token can be permanent. For real auto-posting, use the 60 day long-lived one and set up auto-refresh.

③ Why build an app and get a token? (what this whole thing is for)

Think of a Meta App as a permission request form between you and Meta, plus one restricted key. Meta does not hand you an account password, it issues a token that can only do specific things. That way it knows who is using which permission, and it can revoke access at any time.
Meta opens this up because third-party tools make businesses stickier, post more content and buy more ads. That is why this is the official channel for automation that stays within the rules.

④ Development mode vs app review, what is the difference?

Development mode (the app default) : no review, works right away, but it can only touch your own account plus the testers you add. Posting to your own accounts, or serving a handful of clients, is this mode.
App review (Advanced Access) : needed only when the general public should be able to use your app. Meta reviews your use case, asks for a screen recording, and may want business verification.
In one line: development mode plays with your own accounts and skips review, app review plays with everyone's accounts and has to pass. For your own use, or setting up a client, development mode is enough.

Go to developers.facebook.com/apps/ → Create app, fill in the name and contact email, pick a use case (for managing an FB Page pick managing all Page content, for IG or Threads only you can pick Other for now). Once it is built, go to Settings → Basic and note down the App ID and App Secret.

Use Graph API Explorer to pick the app, tick the permissions and generate a short-lived token, then run the line below to exchange it for the 60 day version (swap the uppercase placeholders for your own values):

curl "https://graph.facebook.com/v25.0/oauth/access_token?grant_type=fb_exchange_token&client_id=APP_ID&client_secret=APP_SECRET&fb_exchange_token=SHORT_TOKEN"

Publishing to Instagram takes two calls

First switch IG to a business or creator account and add the Instagram product. To publish: create the container, then publish it.

curl -X POST "https://graph.facebook.com/v25.0/IG_USER_ID/media" -d "image_url=IMAGE_URL" -d "caption=YOUR_CAPTION" -d "access_token=TOKEN"
curl -X POST "https://graph.facebook.com/v25.0/IG_USER_ID/media_publish" -d "creation_id=ID_FROM_PREVIOUS_STEP" -d "access_token=TOKEN"

Threads has its own API (graph.threads.net) and its own App ID. In the app, add the Access the Threads API use case and tick the permissions (threads_basic, threads_content_publish, threads_manage_replies…), then fill in the redirect URL under Settings. Getting a token goes through OAuth:

curl -X POST "https://graph.threads.net/oauth/access_token" -d "client_id=THREADS_APP_ID" -d "client_secret=THREADS_SECRET" -d "grant_type=authorization_code" -d "redirect_uri=YOUR_REDIRECT" -d "code=CODE"
curl "https://graph.threads.net/access_token?grant_type=th_exchange_token&client_secret=THREADS_SECRET&access_token=SHORT_TOKEN"

60 days and it expires. Run a schedule that refreshes about every 50 days and the token stays valid.

curl "https://graph.threads.net/refresh_access_token?grant_type=th_refresh_token&access_token=TOKEN"
curl "https://graph.facebook.com/v25.0/oauth/access_token?grant_type=fb_exchange_token&client_id=APP_ID&client_secret=APP_SECRET&fb_exchange_token=TOKEN"