Facebook Page Access Token
What a Facebook Page access token is, how it differs from a user token, and how long it lasts.
By André LugPublishing to a Facebook Page requires a Page access token, not a User token. The standard exchange: swap a short-lived User token for a long-lived one (about 60 days), then call GET /me/accounts to get a Page token that Meta documents as having no fixed expiry. PostGate's hosted connect flow performs the exchange and stores the token; your product only ever sees a profile_id.
Every write to a Facebook Page — a post, a comment reply, a Reel — is authorized by a Page access token, not the token of the person who clicked "Allow." Getting one the standard way is a multi-step exchange with a real expiry model to track; connecting through PostGate collapses that into one hosted flow and hides the token entirely.
How is a Page token different from a User token?
POST /{page-id}/feed — a User token alone can't create content on a Page's behalf, even for that Page's own admin.The standard exchange, if you did it yourself
GET /me/accounts, which returns a Page access token for every Page the user administers. Meta's own docs describe Page tokens obtained this way as not carrying a fixed expiration — they last until something invalidates them, rather than until a clock runs out.What still invalidates a "non-expiring" token?
How does this look through PostGate?
POST /api/profiles/connect generates a hosted URL; your customer authorizes the Page on Meta's own domain; PostGate performs the long-lived exchange and stores the resulting Page token server-side. Your product only ever sees a profile_id.curl -X POST https://postgate.studio/api/profiles/connect \
-H "Authorization: Bearer $POSTGATE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"platform": "facebook",
"profile_group_id": "grp_acme123",
"return_url": "https://app.example.com/settings/social"
}'Monitor health instead of guessing when it will break
GET /api/profiles/{id}/health for status, granted scopes, and a reconnect_required flag, and prompt the customer to reconnect when it flips.curl https://postgate.studio/api/profiles/pro_facebook789/health \
-H "Authorization: Bearer $POSTGATE_API_KEY"Frequently asked questions
Can I post to a Facebook Page with a User access token?
No. A User access token represents the person; a Page access token represents the Page and is derived from it. Meta requires the Page token for publishing calls like POST /{page-id}/feed — a User token alone can’t create content on a Page’s behalf, even for that Page’s own admin.
Do Facebook Page access tokens expire?
Page tokens obtained via the standard exchange — a short-lived User token swapped for a long-lived one (about 60 days), then GET /me/accounts — are described in Meta’s own docs as not carrying a fixed expiration. They last until something invalidates them, rather than until a clock runs out. Not having an expiry date is not the same as being permanent, though.
What invalidates a Facebook Page access token?
A Page token stops working if the admin who granted it changes their Facebook password, revokes the app’s access, loses their admin role on the Page, or if the app itself is deauthorized. Any of these means you need to reconnect the Page — not just refresh a token.
How do I know when a Facebook Page connection needs reconnecting?
Rather than tracking an expiry date that may not exist, poll GET /api/profiles/{id}/health for status, granted scopes, and a reconnect_required flag, and prompt the customer to reconnect when it flips. PostGate stores the Page token server-side, so this health check is the signal your product acts on.
