Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

Meta (Facebook / Instagram / WhatsApp)

You can create an app and test with your own accounts, but advanced permissions need App Review, business verification and a Data Protection Assessment, with an annual Data Use Checkup afterwards. No durations were found in official pages.

Tier 4 · Gated / partner approval30-90 min hands-onResearched 2026-10-20
DifficultyTier 4 · Gated / partner approval

Sourced Meta says advanced permissions require business verification and a Data Protection Assessment, and permissions are assessed through App Review. [e1]

Your time (hands-on)30-90 min

Inferred Our estimate for creating the app and business portfolio; review preparation is much larger and not estimated.

Approval waitNot published

Unknown Neither the app-modes page nor the App Review page we read states how long review takes. [e1]

Composio managed authAvailable

Sourced Composio's Facebook toolkit page lists OAuth2 and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits. This is the toolkit page for Facebook; Instagram and other Meta toolkits were not each checked.

Open Composio's toolkit page

Who does what

An agent can

  • Map the permissions you need to review requirements and draft submission notes.

You must

  • Provide business verification documents and own the review process.

Steps

  1. Create a Meta developer account and business portfolioYouSourced

    The app must be linked to both. [e2]

    Why you: Account and business identity creation.

  2. Create the app and pick use casesYouSourced

    Create App > details > use cases > select your business. [e2]

    Why you: Needs your signed-in Meta account.

  3. Copy App ID and App Secret; add the redirect URIYouSourced

    App Settings > Basic for credentials; App Settings > Advanced for the redirect allow list. [e2]

    Why you: Secret goes to your secret store.

  4. Create the Composio auth configYou or agentSourced

    Own credentials; base URL https://graph.facebook.com; no Bearer Token support. [e2]

  5. For permissions beyond your own testers: App Review pathYouSourced

    Business verification, Data Protection Assessment, and App Review submission. [e1]

    Why you: Business documents and review communication are yours.

Requirements

  • Sourced An app must be linked to a developer account and a business portfolio (Composio's guide). [e2]
  • Sourced Advanced permissions require business verification. [e1]
  • Sourced For advanced permissions, complete the Data Protection Assessment. [e1]
  • Sourced New apps start in Development mode, where only people with a role on the app (admins, developers, testers) can grant permissions. [e3]
  • Sourced Live mode lets anyone use the app, but only for permissions approved through App Review. [e4]

Scopes and access

  • Sourced Permissions are requested through App Review; annual Data Use Checkup certifies permissions are used in line with Platform Terms. [e1]

Review process

  • Sourced App Review assesses permission requests; live chat support is available if rejected. [e1]
  • Sourced Meta calls App Review an important part of app development. The pages we read give no review duration. [e5]

Gotchas

  • Inferred Composio's Meta guide ends with 'you can finally publish the application' and never mentions App Review, business verification or live mode, so it can leave you with an app that works only for developers and testers. [e2][e1]
  • Sourced Composio's guide does not explain how to create the business portfolio it requires. [e2]

If you get stuck

Inferred Only you and listed testers can authorize

Likely cause: Permissions not approved for public use yet.

Fix: Complete App Review and the required verification for advanced permissions.

Escalate when: Rejected in review; Meta offers live chat support after rejection. [e1]

Next actions

  • Create the business portfolio first; it blocks app creation.
  • Read the permission-specific review requirements before building features that need them.

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • No Meta page we read states a duration for App Review or Business Verification; blogs claim numbers but were not used.
  • The App Review page we read does not list required screencasts or test instructions; Meta's content and best-practice pages were not read.
  • Which permissions need advanced access per use case was not enumerated.
  • Business Verification requirements page failed to load in this pass.
  • No hands-on test logged yet.

Sources

  1. [e1] Meta for Developers - Trust Center
    Advanced permissions that you request will require business verification.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - Facebook (Meta) OAuth credentials
    With all of that, you can finally publish the application.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] Meta for Developers - App modes
    Apps in Development mode can only request permissions from role users.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] Meta for Developers - App modes
    Apps in Live mode can request permissions from anyone, but only permissions approved through App Review.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] Meta for Developers - App Review
    App Review is an important part of the app development process.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Composio docs - Facebook toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.