Integrations

Meta Ads

Connect Meta Ads to manage campaigns, ad sets, ads, and creatives, and track insights, audiences, and lead ads.

API credentialsApp reviewAds & SocialMeta Ads API docs

You end up with a never-expiring System User access token from Meta Business settings, and optionally your app's App Secret, to paste into PopMCP.

App review before this connector works

Meta must grant your app Advanced Access to the ads_management and ads_read permissions through App Review, and your business must pass Meta Business Verification, before the app can touch ad accounts belonging to people who have no role on your app.

Typical wait
Not published by Meta - there is no stated SLA. Business Verification is commonly reported to take several business days to about two weeks; App Review is often days but developers widely report weeks, especially on resubmission. Treat any figure as community-reported, not vendor-stated.
Cost
Free - Meta charges nothing for App Review or Business Verification; you supply company registration documents.
Blocked until approved
Without Advanced Access you cannot call the Marketing API on behalf of any third-party advertiser: 'Permissions with Standard Access can only be requested from app users who have a role on the requesting app', so every customer you did not add as an app admin/developer/tester returns a permissions error. Business Verification is a hard prerequisite - 'Advanced Access now requires Business Verification'. Separately, the Marketing API Access Tier (renamed from Ads Management Standard Access effective 4 May 2026) starts every app at Limited Access, which caps rate limits and withholds some endpoints until the app qualifies for Full Access.
Works meanwhile
Standard Access is available without review, so you can read and write ads on any ad account where the authorizing user has a role on your app. That covers the whole single-tenant case - your own or your agency's ad accounts - using a user token or a Business Manager system user token, with live data and no review at all. Build and test the entire integration this way.

Where to apply: Meta App Dashboard (developers.facebook.com/apps) > App Review > Permissions and Features: find ads_management and ads_read and click 'Request Advanced Access'. Business Verification is completed first in Meta Business Manager > Business Settings > Security Centre > Business Verification. Marketing API Access Tier status and its requirements are now displayed directly in the App Dashboard.

  • Submitting App Review before Business Verification has completed gets the submission bounced back - verify the business first.
  • Screencasts are the top rejection cause for ads_management App Review. Meta asks for three: the complete Facebook Login flow granting the permission, how businesses access ads performance data in your product, and successful display of key metrics such as 'Impressions, Conversions, Spend, Clicks, and Reach'. Generic product demos are rejected. Note the separate change: the screen recording requirement was removed for the Marketing API Access Tier upgrade, NOT for App Review - do not confuse the two.
  • Reviewers need working test credentials for your app; if they cannot log in, the request is rejected without a real review.
  • Advanced Access requires a live, publicly reachable privacy policy URL and a completed Data Use Checkup, which must be re-done annually or access is revoked.
  • Full Access on the Marketing API Access Tier needs 500+ Marketing API calls in the past 15 days with an error rate under 15% measured over your most recent 500 calls (lowered from 1,500 calls on 4 May 2026) - so you must ship on Limited Access and generate real traffic before you can qualify. The tier change required no code changes and existing access levels were preserved.
  • The business name and documents must match the legal entity exactly; mismatched trading names are a frequent verification failure.
  • Ad account and Business Manager restrictions (common on brand-new business accounts) block API calls regardless of app permissions.
Setup time
12 min
Auth
API credentials
API base URL
https://graph.facebook.com
Rate limits
Marketing API calls are governed by Business Use Case rate limits that scale with the ad account's spend rather than a fixed number. The X-Business-Use-Case-Usage header reports usage, and error 17 means you are throttled.

Before you begin

  • Admin role on the Meta business portfolio that owns the ad account. Only admins can create system users or generate their tokens.
  • A Meta app at developers.facebook.com with the Marketing API product added.
  • The ad account you want to reach must already be owned by, or shared with, that business portfolio.
  • Advanced access to ads_management, which usually needs App Review before the token works on ad accounts outside your own business.

Get your credentials

Create a system user

Open business.facebook.com/settings, pick the business portfolio that owns your ad account, then go to Users → System users and click Add. Name it PopMCP, choose the Admin system user role, and click Create system user.

Open this screen →

business.facebook.com/settings/system-users
Search business settingsAcme Supply
Business settings / Users / System users

System users

System users are automated accounts that call the Meta APIs on behalf of your business.

Add
NameRoleAssigned assetsCreated
Reporting botSystem userEmployee2 assetsJan 12, 2026
Catalog syncSystem userAdmin5 assetsMar 4, 2026
Create system user
System user name
PopMCP
System user role
Admin
CancelCreate system user

System users belong to the business portfolio, not to a personal Facebook profile.

Assign the ad account and the app

Select the new system user and click Add assets. Under Ad accounts tick your account, turn on Manage campaigns, and click Save changes. Repeat with the Apps asset type and pick the Meta app whose credentials you will use.

Open this screen →

business.facebook.com/settings/system-users
Search business settingsAcme Supply
Business settings / Users / System users / PopMCP

PopMCP

Admin system user

Assigned assetsGenerated tokens
Add assetsGenerate new tokenRemove
Select assets and assign permissions
Asset type
Ad accounts
Selected
Acme Store Ads (act_****3271)
View performanceRead insights and reports
Manage campaignsCreate and edit campaigns, ad sets and ads
Manage ad accountChange billing and account settings
CancelSave changes

View performance on its own is read-only and blocks every write tool.

Generate a never-expiring token

On the system user, click Generate new token. Select your app, set Token expiration to Never, tick ads_management, ads_read and business_management, then click Generate token.

Open this screen →

business.facebook.com/settings/system-users
Search business settingsAcme Supply
Business settings / Users / System users / PopMCP

Generate token

Permissions are baked into the token when it is generated.

Generate token
Select app
PopMCP Connector
Token expiration
Never
ads_managementCreate and edit campaigns, ad sets, ads and creatives
ads_readRead insights and campaign structure
business_managementRead the business portfolio, catalogs and asset links
leads_retrievalOnly if you use the lead ads tools
CancelGenerate token

The Available Permissions list only shows scopes your app has been granted.

Copy the token now

Click the copy icon in the confirmation dialog and store the token somewhere safe, then click OK.

business.facebook.com/settings/system-users
Search business settingsAcme Supply
Business settings / Users / System users / PopMCP

System users

Assigned assetsGenerated tokens
This is the only time the full token is shown.
AppScopesExpiresStatus
PopMCP ConnectorApp ID 8812****ads_management, ads_read, business_managementNeverActive
Your access token
System user access token
EAAG****************************9d4c
CopyOK

Losing the token is recoverable. Generate a new one and the old one keeps working until you revoke it.

Optionally add the App Secret, then paste into PopMCP

If your app has Require app secret turned on, open developers.facebook.com/apps → your app → App settings → Basic and click Show next to App secret. In PopMCP paste the token into System User access token, paste the secret into App Secret (optional), and save.

Open this screen →

Connect in PopMCP

Open your workspace, choose Meta Ads in the marketplace, and fill in the connect dialog:

FieldWhat to enter
System User access tokensecretBusiness Settings → Users → System users → (create or open one) → Generate token. Assign the ad account to the system user first, and grant ads_read or ads_management (plus business_management for catalog/business operations). Choose 'never' for expiry. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again.
App Secret (optional)secretApp Dashboard → Settings → Basic → App secret. When set, every call carries the computed appsecret_proof. Leave blank unless your app requires it. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again.

PopMCP verifies the credential against Meta Ads immediately. On success the connection flips to Verified and its MCP tools are provisioned.

Verify it worked

The Meta Ads connector in PopMCP flips to Connected and lists your ad accounts by name and act_ id. Asking for last week's campaign spend returns real numbers.

Troubleshooting

OAuthException code 190: Invalid OAuth access token

Why: The token was revoked, the system user lost its app assignment, or a short-lived token from the Graph API Explorer was pasted instead of the system user token.

Fix: Re-assign the app to the system user in Business settings and generate a fresh token with Token expiration set to Never.

(#200) Requires ads_management permission

Why: The token was generated before the app had that permission, or only ads_read was ticked.

Fix: Generate a new token with ads_management ticked. Permissions are fixed at generation time, so adding them later does not upgrade an existing token.

(#100) Unsupported get request on act_XXXX

Why: The ad account was never assigned to the system user, or it is owned by a different business portfolio.

Fix: Open Business settings → Users → System users → your user → Add assets → Ad accounts, tick the account and turn on Manage campaigns.

The token never appears after clicking Generate new token

Why: The Meta app was not assigned to the system user, so there is nothing to select in the app dropdown.

Fix: Add the app under the Apps asset type first, then generate the token.

(#17) User request limit reached

Why: Meta's Business Use Case rate limits, which scale with the ad account's spend, have been hit.

Fix: Slow down and retry later. The X-Business-Use-Case-Usage response header reports how much of the budget is consumed.

Invalid appsecret_proof provided

Why: The App Secret belongs to a different app than the one the token was generated for.

Fix: Clear the App Secret field, or paste the secret from the exact app you chose in the Generate token dialog.

Reference

On this page