Meta Ads API Access Token: Which One and How to Get It

A Meta Ads API access token is the credential every Marketing API call carries. There are two kinds that work on ad accounts: a user access token, which a person grants through Facebook Login, and a system user access token, which belongs to a system user in a business portfolio. If your product manages your customers' ad accounts, you want long-lived user tokens, one per customer.

This guide shows how to get each token, which permissions to request, and how to tell why a token stopped working. It's part of our Meta Ads API series.

Which token does the Meta Ads API use?#

The Meta Ads API accepts a user access token or a system user access token on ad account calls. Meta's authentication guide says "Every Marketing API call requires an access token as a parameter," and describes those two types.

Meta's lead retrieval guide accepts "a Page or User access token requested by a person who can advertise on the ad account." For campaigns, ad sets, ads, and insights, use the user or system user token. Our Facebook Page access token guide covers Page tokens.

Which permissions does the token need?#

A Meta Ads API token needs ads_management to change ads, or ads_read to report only. The token carries whatever the person approved on the consent screen, so request the scopes in the Facebook Login scope parameter.

Source: Meta's permissions reference. For ad accounts you don't own, Meta's authorization guide says you need Advanced Access to ads_management or ads_read, which requires Business Verification.

The token is also bounded by the person's role. A token from someone without a role on an ad account can't reach that account, whatever the scopes say.

How to get a Meta Ads API access token for testing#

The Graph API Explorer generates a short-lived user token for your own ad accounts in about a minute. Meta's authentication guide lists the steps:

1. Open the Graph API Explorer and pick your app under Meta App.
2. Under User or Page, choose User Token.
3. Add ads_read or ads_management under Permissions.
4. Click Generate Access Token and approve the dialog.

Test the token by listing your ad accounts:

curl -G "https://graph.facebook.com/v26.0/me/adaccounts" \
  --data-urlencode "fields=name,account_status" \
  --data-urlencode "access_token=$USER_TOKEN"

How to get a token from your customers in production#

Production tokens come from Facebook Login: your customer approves the scopes, and your server exchanges the code. This is the flow for a platform that manages ads on its customers' accounts.

Step 1: Send the customer to the login dialog#

Redirect to Meta's OAuth dialog with your App ID, a redirect URI, and scope=ads_management,business_management. After the customer clicks Allow, Meta redirects to your URI with a code.

Step 2: Exchange the code on your server#

curl -G "https://graph.facebook.com/v26.0/oauth/access_token" \
  --data-urlencode "client_id=$APP_ID" \
  --data-urlencode "redirect_uri=$REDIRECT_URI" \
  --data-urlencode "client_secret=$APP_SECRET" \
  --data-urlencode "code=$CODE"

The response holds a short-lived user token.

Step 3: Exchange it for a long-lived token#

curl -G "https://graph.facebook.com/v26.0/oauth/access_token" \
  --data-urlencode "grant_type=fb_exchange_token" \
  --data-urlencode "client_id=$APP_ID" \
  --data-urlencode "client_secret=$APP_SECRET" \
  --data-urlencode "fb_exchange_token=$SHORT_LIVED_TOKEN"

Meta's long-lived token guide says to make this call from your server, and that you can't use an expired token to request a long-lived one. Store the result against the customer, never in a browser or mobile app.

Rashed Talukder made the same point about app credentials on the Meta for Developers blog in December 2022:

"It's important to remember that you should never embed an App Access Token in a mobile or desktop application."

The App Secret used in Steps 2 and 3 falls under the same rule. Keep it, and the tokens it mints, on the server.

When should you use a system user token instead?#

Use a system user access token when your own server acts on assets your own business portfolio owns or has been shared. Meta's guide says system user tokens are "useful for server-to-server interactions where there is no user present to authenticate." They don't depend on an employee's login, so a password change doesn't break them.

A system user can only reach assets assigned to it in your business portfolio, so it isn't a way to reach a customer's ad account without their consent. The setup, limits, and expiry options are in our Meta system user access token guide.

How do I debug a Meta Ads API access token?#

Call debug_token to see whether a token is valid, when it expires, and which scopes it holds. You can also paste it into Meta's Access Token Debugger.

curl -G "https://graph.facebook.com/debug_token" \
  --data-urlencode "input_token=$USER_TOKEN" \
  --data-urlencode "access_token=$APP_ID|$APP_SECRET"

The response includes is_valid, expires_at, data_access_expires_at, and scopes. Meta warns in its access token guide that lifetimes "may change without warning or expire early," so read expires_at instead of hardcoding 60 days.

These are the errors you'll see most, from Meta's Graph API error handling page:

Treat 190 as a reconnect. Retrying a dead token only adds to your call count.

How does Adeli handle Meta Ads tokens?#

Adeli runs the Facebook Login step for your customers and calls the Marketing API with their connection, so your product never stores a Meta token. Your server holds one Adeli API key.

• Connect. Adeli uses Facebook Login for Business. Approved opt-in Ads grants add ads_management, business_management, pages_manage_ads, and leads_retrieval to the Facebook connection, per the connect docs.
• No ads_read. The Ads docs say Adeli uses ads_management for reads and management and doesn't request ads_read.
• Older connections. A Facebook connection made before the Ads grants is sent through an explicit authorization flow before any Marketing API request.
• Clear errors. A healthy connection missing a required permission returns 403 permission_required, and an expired credential is reported as a separate error.

Meta's access tier and the customer's ad-account role still apply. AI marketing platforms use the Ads endpoints with the same key as the rest of Adeli's Facebook API, and Adeli bills per user profile; see pricing.