Connect Facebook to publish and schedule posts, photos, videos and Reels, reply to comments and reviews, answer Messenger, and track performance.
You end up pasting the App ID and App Secret of a Meta app that has Facebook Login for Business added and PopMCP's callback URL whitelisted.
App review before this connector works
Meta's own access-levels doc states "Business Verification is required to get Advanced Access" and that "in some cases additional App Review on an individual permission and feature basis might be required". Without Advanced Access on the Pages permissions the app only works for people who hold a role on it.
- Typical wait
- Meta does not publish an SLA for either step. Developers commonly report Business Verification completing in a few days to about two weeks, and App Review in anywhere from 2 business days to several weeks; a rejection sends the permission back to the start of the queue. Treat any specific figure as a report, not a commitment.
- Cost
- No fee. Business Verification requires uploading company registration or similar documents, and Meta must be able to match the business to public records.
- Blocked until approved
- With Standard Access only, Meta states that "permissions with Standard Access can only be requested from app users who have a role on the requesting app". Every token minted for anyone else comes back without the Pages scopes, so reading or publishing to a client's or customer's Page fails. pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, pages_messaging and read_insights are all affected.
- Works meanwhile
- Standard Access is granted automatically, so the full integration can be built and tested end to end against Pages you administer, using accounts added to the app as admins, developers, or testers. Add each teammate's Page under an app role and everything behaves exactly as it will in production.
Where to apply: developers.facebook.com > your app > App Review > Permissions and Features (request Advanced Access per permission). Business Verification is at business.facebook.com > Business Settings > Security Centre, and must be completed on the business the app is linked to.
- Business Verification gates Advanced Access, so submitting for permissions before verification has completed is the most common reason a submission goes nowhere. Verify first, then submit.
- Meta's App Review doc warns that if reviewers cannot access your app for testing, "your entire submission will be rejected" - so a live privacy policy URL, working test credentials, and a screencast showing each requested permission actually in use are effectively mandatory.
- The screencast must demonstrate every requested permission. Asking for pages_manage_posts while the video only shows reading gets the whole submission rejected, not trimmed.
- Apps with Advanced Access must pass an annual Data Use Checkup or permissions are revoked.
- App type matters: create the app as a Business type app. Consumer apps cannot request most Pages permissions.
- Rejection resets the review clock for that permission, so a sloppy first submission can cost weeks.
- Setup time
- 20 min (plus App Review if non-admins will connect)
- Auth
- OAuth authorization
- API base URL
- https://graph.facebook.com
- Rate limits
- Pages calls fall under Meta's business use case rate limits, roughly 4800 calls per engaged user per rolling 24 hours, counted per Page rather than per app.
Before you begin
- A Facebook account registered as a developer at developers.facebook.com
- Admin (or full task access) on the Facebook Page you want PopMCP to manage
- A Meta Business portfolio to attach the app to
- Business verification plus App Review approval before anyone who is not an app admin, developer or tester can connect
- A public Privacy Policy URL, because App settings / Basic will not save without one
Get your credentials
Create a Meta app for your Page
Go to My Apps and click Create app, enter an app name and contact email, then click Next. On the use case screen select Manage everything on your Page, attach a business portfolio, and finish the wizard.
Add use cases
Your use case decides which products, permissions and settings are added to the app.
The Page use case adds Facebook Login for Business to the app for you.
Whitelist PopMCP's callback URL
In the left nav open Facebook Login for Business and click Settings. Paste the callback URL from PopMCP's connect screen into Valid OAuth Redirect URIs under Client OAuth settings, then click Save changes.
Facebook Login for Business settings
Control how people log in and which redirect URIs this app accepts.
Newer use-case apps show a single Redirect URI box with a Check URI button beside it.
Add the Page permissions your tools need
Open App review and then Permissions and features. Add pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_engagement, pages_manage_metadata, pages_messaging and read_insights.
Copy the App ID and App Secret
Open App settings and then Basic. Copy the App ID, click Show next to App secret and re-enter your Facebook password, then paste both values into PopMCP.
Basic
App details shown to people who connect, plus the credentials your server uses.
- App ID
- 1029384756102938
- App secret
- a1b2****9f3c
- App mode
- Development
| App role | Person | Status |
|---|---|---|
| AdministratorFull access | Dana Reyes | Active |
| TesterCan use unapproved permissions | Sam Okafor | Pending |
The secret is revealed only after a password prompt. PopMCP stores it encrypted and uses it server-side.
Submit for review and switch the app Live
Complete Verification and Data handling questions, then submit the Page permissions under App review. Once approved, open Go live and switch the app to Live.
Connect in PopMCP
Open your workspace, choose Facebook in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| App IDtext | Your Facebook app's App ID from developers.facebook.com/apps (App settings, Basic). The app needs the Facebook Login product added, and the callback URL above listed under Valid OAuth Redirect URIs. |
| App Secretsecret | Same screen as the App ID (click Show). Stored encrypted, used server-side only, and never sent to the browser or to any tool.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/facebook/callbackOnly needed if you connect with your own Facebook app: add this exact URL under Facebook Login, Settings, Valid OAuth Redirect URIs (developers.facebook.com/apps, your app). It must match character for character or Facebook rejects the authorization.
PopMCP verifies the credential against Facebook immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Facebook at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| public_profile | Required by the tools this connector exposes. |
| pages_show_list | Lets PopMCP list the Pages you manage so you can pick one. |
| pages_read_engagement | Reads Page content, comments and reactions behind the read tools. |
| pages_read_user_content | Required by the tools this connector exposes. |
| pages_manage_posts | Required to create, schedule, edit and delete Page posts, photos, videos and Reels. |
| pages_manage_engagement | Needed to reply to, hide or delete comments on your Page. |
| pages_manage_metadata | Needed to subscribe the Page to webhooks and update Page settings. |
| pages_manage_cta | Required by the tools this connector exposes. |
| pages_messaging | Powers reading and answering Messenger conversations for the Page. |
| read_insights | Backs the Page and post performance tools. |
| business_management | Lets the app resolve Pages owned through a Business portfolio rather than a personal account. |
| leads_retrieval | Only needed if you want PopMCP to pull lead-ad submissions. |
| publish_video | Required by the tools this connector exposes. |
Verify it worked
Saving the App ID and App Secret opens the Facebook OAuth window. After you approve and pick a Page, the connector shows the Page name with a green Connected badge and the Page tools appear in your tool list.
Troubleshooting
"URL Blocked: This redirect failed because the redirect URI is not whitelisted"
Why: The callback URL is missing from Valid OAuth Redirect URIs, or differs by a trailing slash or http versus https.
Fix: Copy the callback URL straight out of PopMCP into Facebook Login for Business, Settings, and save again. Meta matches the URI character for character.
Facebook Login for Business is not in the left nav
Why: Use-case apps expose the settings through the use case instead of as a top-level product.
Fix: Open Use cases, click Customize on Manage everything on your Page, then open Settings. Apps created years ago list it as plain Facebook Login.
Error 200: "Requires pages_manage_posts permission"
Why: The permission was never added to the app, or it is added but unapproved and the connecting user is not an app admin, developer or tester.
Fix: Add the permission under App review, and while it is unapproved add the person under App roles as an admin, developer or tester.
"Error validating application. Invalid application ID" or error 101
Why: The App ID or App Secret was mistyped, or the secret was rotated after you pasted it.
Fix: Re-copy both values from App settings, Basic, and re-save the PopMCP connection.
Only your own Page appears and nobody else can connect
Why: The app is still in Development mode.
Fix: Finish business verification and App Review, then switch the app to Live from Go live.