# Facebook Page Access Token: Get One That Doesn't Expire

How to get a Facebook Page access token: user token, long-lived user token, then /me/accounts. Why it has no expiration date, which permissions, and the errors.

Canonical page: https://www.tryadeli.com/blog/facebook-page-access-token
Last updated: 2026-10-12

By Mika Reyes, Co-founder, Adeli. Published 2026-10-12.

## The short answer

A Facebook Page access token comes from a user token. Log the Page admin in with Facebook Login, exchange the short-lived user token for a long-lived one (about 60 days) on your server, then call the accounts edge to read each Page's token. Meta says a Page token made from a long-lived user token has no expiration date. Adeli runs this flow and stores the tokens for you.

A Facebook Page access token is the credential your app uses to act as a Facebook Page, for publishing posts, managing comments, and reading insights. You get it **from a user token**. A Page admin logs in with Facebook Login, your server swaps their short-lived user token for a **long-lived one**, and the `accounts` edge returns a token for each Page they manage. Meta says that Page token **has no expiration date**.

This guide walks the three requests, the permissions, and the errors that kill a token that "never expires." It's part of our [Facebook Graph API](https://www.tryadeli.com/blog/facebook-graph-api) series.

## What is a Facebook Page access token?

**It's a token scoped to one Page, one admin, and one app.** Meta's [access token guide](https://developers.facebook.com/docs/facebook-login/guides/access-tokens) says Page access tokens "let you read, write, and modify data belonging to a Facebook Page," and that they're unique to each Page, admin, and app combination.

Three tokens show up in a Pages integration:

| Token | What it does | How you get it |
|---|---|---|
| **User access token** | Acts as the person who logged in | Facebook Login |
| **Page access token** | Acts as one Page | Exchanged from a user token |
| **App access token** | Reads and changes app settings | Server-to-server call with your app secret |

Posting to a Page, reading its comments, and pulling its insights all need the **Page** token, not the user token.

## What do you need before you start?

- **A Meta app** with Facebook Login, and its App ID and App Secret.
- **A Page role.** Meta says the person requesting the token must have a role on the Page, and posting needs the `CREATE_CONTENT` task.
- **Three permissions** granted on the consent screen:

| Permission | What Meta says it allows | Depends on |
|---|---|---|
| `pages_show_list` | Access the list of Pages a person manages | Nothing |
| `pages_read_engagement` | Read content posted by the Page, followers data, and Page metadata | `pages_show_list` |
| `pages_manage_posts` | Create, edit, and delete the Page's posts | `pages_read_engagement`, `pages_show_list` |

Source: Meta's [permissions reference](https://developers.facebook.com/docs/permissions). For Pages you don't own, each permission needs **Advanced Access**, which means Business Verification and App Review. Our [Meta app review guide](https://www.tryadeli.com/blog/meta-app-review-time) covers the timeline.

## Step 1: Get a user access token

**Run Facebook Login and take the user token it returns.** That token is short-lived: Meta says short-lived tokens "typically last about one to two hours," and that default User and Page tokens are short-lived, "expiring in hours."

For a quick test on your own Page, the [Graph API Explorer](https://developers.facebook.com/tools/explorer/) can generate one. Pick your app, add the three permissions, and click Generate Access Token.

## Step 2: Exchange it for a long-lived user token

**Call `oauth/access_token` from your server with `grant_type=fb_exchange_token`.** The request includes your App Secret, so Meta's [long-lived token guide](https://developers.facebook.com/docs/facebook-login/guides/access-tokens/get-long-lived) says to make it **from your server, never a client**:

```bash
curl -G "https://graph.facebook.com/v26.0/oauth/access_token" \
  --data-urlencode "grant_type=fb_exchange_token" \
  --data-urlencode "client_id=$APP_ID" \
  --data-urlencode "client_secret=$APP_SECRET" \
  --data-urlencode "fb_exchange_token=$SHORT_LIVED_USER_TOKEN"
```

The long-lived user token **generally lasts about 60 days**. Do this before the short-lived token runs out: Meta says you can't use an expired token to request a long-lived one.

## Step 3: Get the Page token from /me/accounts

**Call the user's `accounts` edge with the long-lived token.** Meta's guide uses the app-scoped user ID, and the [Pages API getting started guide](https://developers.facebook.com/docs/pages-api/getting-started) uses `/me/accounts` in the Explorer. Both return the same list:

```bash
curl -G "https://graph.facebook.com/v26.0/me/accounts" \
  --data-urlencode "access_token=$LONG_LIVED_USER_TOKEN"
```

Each object in the `data` array is one Page, with `id`, `name`, `category`, `tasks`, and its own **`access_token`**. Store that token against the Page ID. Check `tasks` too: a Page without `CREATE_CONTENT` can't be posted to.

**Test it with a post.** Meta's getting started guide publishes with a `POST` to the Page's `/feed` edge:

```bash
curl -X POST "https://graph.facebook.com/v26.0/$PAGE_ID/feed" \
  -d "message=Hello from the Pages API" \
  -d "access_token=$PAGE_TOKEN"
```

A response with an `id` means the token works.

## Does a Facebook Page access token expire?

**A Page token from a long-lived user token doesn't have an expiration date.** Meta's wording: long-lived Page access tokens "do not have an expiration date and only expire or are invalidated under certain conditions." A Page token from a short-lived user token is short-lived, so the order of Steps 2 and 3 matters.

| Token | Lifetime, per Meta |
|---|---|
| **Short-lived user token** | About 1 to 2 hours |
| **Long-lived user token** | About 60 days |
| **Page token from a short-lived user token** | Short-lived, expiring in hours |
| **Page token from a long-lived user token** | **No expiration date** |

Meta also warns not to depend on these lifetimes staying the same, because they "may change without warning or expire early." Store the token's expiry from [`debug_token`](https://developers.facebook.com/docs/graph-api/reference/debug_token) and check it rather than hardcoding a number.

## Why did my Page access token stop working?

**"No expiration date" doesn't mean it can't die.** Meta's [token error guide](https://developers.facebook.com/docs/facebook-login/access-tokens/debugging-and-error-handling) lists logouts, password changes, removed app authorization, and security events as ways a token is invalidated early. It also says **Facebook will not notify you** when a token becomes invalid. You find out when a call fails.

These are the codes to catch, from Meta's [Graph API error handling](https://developers.facebook.com/docs/graph-api/guides/error-handling) page:

| Error | Meaning | Fix |
|---|---|---|
| **190, subcode 463** | Token expired | Send the admin back through login |
| **190, subcode 467** | Invalid access token | Send the admin back through login |
| **190, subcode 460** | Password changed | The admin logs in to your app again |
| **190, subcode 458** | App not installed, or authorization removed | Reauthenticate the user |
| **190, subcode 459 or 464** | User checkpointed or unconfirmed | The admin logs in at facebook.com to fix the account |
| **190, subcode 492** | The user behind the Page token lacks a suitable Page role | Have a current admin reconnect |
| **10 or 200–299** | A permission was never granted or was removed | Request the missing permission again |
| **4 or 17** | Throttling | Wait, retry, and check your call volume |

**Check a token's state** with `debug_token`. It returns `is_valid`, the expiry times, and the granted scopes, and you call it with a token from the **same app**:

```bash
curl -G "https://graph.facebook.com/debug_token" \
  --data-urlencode "input_token=$PAGE_TOKEN" \
  --data-urlencode "access_token=$APP_ACCESS_TOKEN"
```

A few habits that save debugging time:

- **Never ship tokens to the client.** Meta tells you to move tokens over HTTPS and use app tokens only server to server.
- **Store one token per Page, not per user.** Page tokens are unique to the Page, admin, and app, so an admin with five Pages gives you five tokens.
- **Treat error 190 as a reconnect, not a retry.** Retrying an invalid token just burns calls.

## How does Adeli handle Facebook Page tokens?

**Adeli runs this flow for you and never hands you a Facebook token.** [Adeli's Facebook API](https://www.tryadeli.com/product/facebook) holds the Meta app, carried Meta's review, and stores and refreshes each connected Page's credentials. You hold **one API key**.

1. **Start a connection.** Your server calls [`POST /api/v1/profiles/{profileId}/connect`](https://www.tryadeli.com/docs/api/connect) and sends your customer to the `authUrl` it returns. Adeli uses Facebook Login for Business and requests the Pages permissions, including `pages_show_list`, `pages_read_engagement`, and `pages_manage_posts`.
2. **Your customer picks a Page.** Authorizing yields a user token that lists their Pages. Until one is chosen, the account shows `connectionStatus: "pending_page_selection"`, and any publish returns `409 page_not_selected`.
3. **Publish.** Send the post to [`POST /api/v1/posts`](https://www.tryadeli.com/docs/api/posts/publish-facebook) with `platform: "facebook"` and the `accountId`. Photos, multi-photo posts, Reels, and feed videos all go through the same call.

Two details from building the Page picker that also apply to your own integration:

- **Only Pages with a direct role.** Adeli offers Pages your customer holds a direct role on. A Page granted only through a business portfolio isn't connectable, because Adeli doesn't request `business_management`.
- **Dead tokens show up as a status.** When a Facebook connection needs fresh consent, the account reports `connectionStatus: "reconnect_required"`, so your UI can ask the customer to reconnect instead of failing a post silently.

When we went through Meta's App Review, each permission was judged on its own screencast and use case. Plan for a submission to come back partly approved.

The same [posting API](https://www.tryadeli.com/social-media-posting-api) publishes to Facebook, Instagram, TikTok, YouTube, X, and Bluesky. A Facebook Page counts as one connected account, and your **first 3 connected accounts are free**.

## Frequently asked questions

### Is there a permanent Facebook Page access token?

The closest thing is a Page access token generated from a long-lived user token. Meta says it has no expiration date and only expires or is invalidated under certain conditions, such as the admin changing their password, logging out, or removing your app. So it's long-lived, not guaranteed forever.

### How long does a Facebook access token last?

A short-lived user token typically lasts one to two hours, and a long-lived user token about 60 days, according to Meta. A Page token from a short-lived user token is short-lived too. A Page token from a long-lived user token has no expiration date.

### What is the Facebook Page API?

It's the part of Meta's Graph API that works on Facebook Pages: publishing posts, reading and replying to comments, and reading Page insights. Every Pages API call that acts as the Page needs a Page access token for it.

### Can I use the Graph API Explorer token in production?

Only for testing your own Pages. The Explorer generates tokens for people with a role on your app. Production apps get tokens through Facebook Login, and serving other people's Pages needs Advanced Access through Meta App Review.

## Related Adeli pages

- [Facebook API for Developers](https://www.tryadeli.com/product/facebook.md): Publish, schedule, and read analytics for Facebook Pages through one API. Adeli owns the Facebook developer app, token refresh, and Meta review. Free to start.
- [Social Media Posting & Scheduling API](https://www.tryadeli.com/social-media-posting-api.md): Adeli's social media posting and scheduling API publishes to Instagram, TikTok, YouTube, Facebook, X, and Bluesky in one request, now or at a set time. Free to start.
- [All posts on the Adeli blog](https://www.tryadeli.com/blog.md)

## About the author

Mika Reyes is the CEO behind Adeli and a tech and AI content creator. She was previously co-founder and CEO of Parallax, which was acquired by Phantom, and a product lead at LinkedIn. She is a Forbes 30 Under 30 honoree.