At a glance
Capabilities
Connecting
auth_url. After they authorize, SocialAPI exchanges the code with Facebook, but the result is never an immediate status=success: every Facebook connect returns a pending connection that asks you to choose which Pages to assign. See OAuth flows: Facebook, choosing which Pages to connect for the full login_id / pages[] / lost_access[] shape and the POST /v1/accounts/pending/{connection_id}/select call that completes it.
One login, many brands
A Facebook login is a shared credential, not a one-to-one link to a brand. The same login can serve many brands at once: each Page you have access to belongs to exactly one brand, but the login behind it, and the OAuth grant that keeps it alive, is shared across all of them. This has two practical consequences:- Assigning Pages is explicit. Connecting a login does not attach every Page it can see to the brand you connected from. Each Page is assigned to a brand only when you select it, either during the connect flow’s pending-selection step or afterward through the endpoints below.
- Re-authenticating refreshes everyone. When you or a teammate re-runs the OAuth flow for a login that already backs one or more brands, the refreshed token and Page grant apply to every brand using that login, not just the one you happened to reconnect from.
Managing Pages after connecting
Pages don’t have to be assigned at connect time. List a login’s current Pages, live from Meta, merged with which brand (if any) already owns each one:409:
403 platform.facebook.page_cap:
Reading samples
List posts
List comments on a post
List DMs
Publishing
Create a Facebook Page post with optional platform-specific fields:Limitations and gotchas
- Shared login, one Page per brand: a single OAuth flow surfaces every Page the login can manage, but each Page belongs to exactly one brand’s
account_id, assigned explicitly during the pending-connection step or later. See One login, many brands. - Page tokens never expire: unlike Instagram, Facebook Page tokens derived from long-lived user tokens do not expire. No reconnection needed unless the user revokes access.
- Private replies: replying to a comment with
"private": truesends a one-time DM to the commenter. Can only be sent once per comment, within 7 days of the comment. - 24-hour messaging window: Pages can send any message within 24 hours of the user’s last message. After that, only approved message tags are allowed. If you get an error sending a DM, the window may have closed.
- Reviews deprecated: Facebook deprecated Page Recommendations/Reviews in Graph API v22.0 (January 2025). The API returns
501for review endpoints.
Permissions
SocialAPI’s managed Meta App already requests these scopes on your behalf:pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_engagement, pages_manage_metadata, pages_messaging, pages_manage_posts, public_profile, business_management. You don’t need to apply for any platform app review. See Platform credentials.