Meta (Facebook Login for Business: Pages, Messenger, Instagram, WhatsApp Business)
Creating the app and testing with your own Page, Instagram account and WhatsApp number takes about an hour. To reach other businesses' accounts you need Advanced Access, and getting it is the slow part: Business Verification, App Review with one screencast and one written use case per permission, and for WhatsApp Embedded Signup also Tech Provider Access Verification. Plan for 2-8 weeks of calendar time. Each rejection restarts the review queue, and every connected Page has to reconnect before its token carries newly approved scopes.
Review: App Review per permission for Advanced Access (screencast + written use case each), Business Verification of the app's business portfolio, and for WhatsApp Embedded Signup the Tech Provider Access Verification; afterwards an annual Data Use Checkup
Timing: First token: 30-60 min (own Page/IG/WhatsApp test number, Standard Access, Development mode). 2-8 weeks from scratch (Business Verification + App Review + Access Verification, often one or more resubmissions); 1-4 weeks to add publishing scopes to an already verified, live app like Iskaria's.
Cost: free to register and review; WhatsApp conversations are billed per message to the client's WhatsApp Business Account (client adds a payment method)
Before you start
- for buildMeta developer account plus a business portfolio (formerly Business Manager) that owns the app. Required for apps that access data the developer does not own.sourcedm13
- for launchPrivacy policy URL on the app (Basic Settings), live and reachable✓ Iskaria has ittestedm17m4
- for launchData deletion instructions URL or a data deletion callback URL (Basic Settings)✓ Iskaria has ittestedm4m17
- for launchApp icon and category in Basic Settings (App Review checks app settings)✗ missing in profilesourcedm6
- for launchBusiness Verification of the business portfolio that owns the app: legal name, address, phone, website, and documents if Meta cannot match public records✓ Iskaria has itsourcedm1m6m12
- for launchScreencasts, one per requested permission (1080p or better, no audio needed)✗ missing in profilesourcedm3
- for buildEach connected client Instagram account must be a professional (Business/Creator) account. On the Facebook Login path it must also be linked to the client's Facebook Page.testedm11m17
- for buildHTTPS domain allowlisted in the app (Allowed Domains for the JS SDK / Embedded Signup) and Valid OAuth Redirect URIs✓ Iskaria has ittestedm8m17
Standard Access, available without review, works only for people who hold a role on the app (admin/developer/tester) and on assets they manage. In Development mode the app can request permissions only from role users. Embedded Signup cannot be tested on localhost: it needs an allowlisted HTTPS domain. A Tech Provider cannot onboard its own business portfolio through Embedded Signup, so test with a separate test business.
Who does what
- Prepare all Basic Settings values from the developer profile
- Draft a distinct App Review use-case description per permission from useCases.meta
- Write screencast scripts (login > consent > action > visible result) per permission
- Implement Facebook Login for Business, the data deletion callback and webhook handlers
- Detect tokens missing new scopes (debug_token) and prompt each clinic to reconnect
- Monitor Graph error codes 10 / 200-299 and surface 'needs review/reconnect'
- Log in to the Meta developer dashboard and create the app (human Facebook account)
- Submit Business Verification with legal documents
- Record the screencasts and submit App Review
- Complete Tech Provider Access Verification
- Switch the app to Live and complete the annual Data Use Checkup
- Have each client verify their own business for WhatsApp templates
Steps
Go to developers.facebook.com > My Apps > Create app. Pick the use cases you need (for example 'Manage everything on your Page', the Instagram messaging/content use case, and 'Connect with customers through WhatsApp'). Use cases cannot be removed later, and the dashboard greys out incompatible ones. When asked, connect the app to your business portfolio (verified or not yet verified).
https://developers.facebook.com/apps/App name Iskaria App contact email ibrahim@iskaria.com Business portfolio Required if the app touches data you don't own App settings > Basic: App domains, Privacy Policy URL, Terms of Service URL, User data deletion (instructions URL or callback URL), icon, category. An agent can prepare all values from the profile; a human pastes them in and saves.
App domains ["iskaria.com"] Privacy Policy URL https://iskaria.com/privacy Terms of Service URL https://iskaria.com/termsConfirm https://iskaria.com/terms is live before submitting User data deletion (Data deletion instructions URL) https://iskaria.com/data-deletion App icon missing: logo.square512PngMissing in profile Add the Facebook Login for Business product. Create a configuration (its config_id) listing only the assets and permissions you need. Set Valid OAuth Redirect URIs (HTTPS) and, for the JS SDK and Embedded Signup, Allowed Domains with Enforce HTTPS on.
Valid OAuth Redirect URIs ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"]Use the https://app.iskaria.com callback Allowed Domains for the JavaScript SDK app.iskaria.com
Log in as an app admin. Connect your own Page, IG professional account and WhatsApp test number, then call the Graph API: send a Messenger/IG reply, publish a test Page post, send a WhatsApp message. Add teammates as app testers; non-role users will fail.
Business portfolio > Security Center > Start verification. Enter the legal name, address, phone and website, and upload a registration or tax document if Meta can't match public records. Then confirm by email, phone or domain. The name must match the documents exactly.
Legal business name missing: legalEntityMissing in profile Website https://iskaria.com/ For each permission, record at 1080p or better with no cuts. Start from the login and consent screen, then show the permission at work end to end: a reply arriving in Messenger/IG, a post visible on the Page, a published IG post, a WhatsApp message received in the WhatsApp client and a template created. Reviewers follow the video, so use the same test account you give them.
- 7Submit App Review for Advanced AccessAgent drafts, you submit1-2 h hands-on; ~1 week official, ~20 days reported per cyclesourcedm3m16
App Review > Permissions and features: request Advanced Access per permission. Write a separate use-case description for each one (don't reuse text), upload its video, and explain in Platform Settings how reviewers can reach the app. An agent can draft the descriptions from useCases.meta; a human submits.
https://developers.facebook.com/apps/Use case description (per permission) Reply to WhatsApp, Instagram and Messenger messages for a clinic; publish the clinic's own posts Screencast (per permission) missing: demoVideoUrlMissing in profile - 8WhatsApp: become a Tech Provider (Access Verification) and enable Embedded SignupYou30 min hands-on; ~5 business days stated, often longersourcedm6m7m14m17
After Business Verification and approval of whatsapp_business_messaging + whatsapp_business_management, complete Access Verification in the WhatsApp dashboard (shown as about 5 business days). Until all three are done, Embedded Signup onboards at most 10 new business customers per rolling 7 days; after them, 200. Test onboarding with a business portfolio other than the one that owns the app.
- 9Switch the app to Live and have every Page reconnectAgent drafts, you submit5 min + per-client reconnecttestedm17m2
Set App Mode to Live. Each client then has to go through Facebook Login for Business again so their Page/IG token carries the newly approved scopes. Old tokens keep failing on publish calls with Graph error 10 or 200-299 until they reconnect. An agent can detect missing scopes (debug_token) and prompt each clinic.
An app admin gets notified 60 days before the app's Data Use Checkup deadline. Review the permissions in use, answer the data-handling questions and certify compliance. Missing it risks losing API access. Keep admin contact details current.
Scopes an agent typically needs
| Scope | Used for | Review tier | Evidence |
|---|---|---|---|
| pages_messaging | Read and reply to the clinic Page's Messenger conversations Depends on pages_manage_metadata and pages_show_list. Iskaria already holds it. | sensitive | testedm5m17 |
| pages_manage_posts | Publish, edit and delete the clinic's own Page posts Depends on pages_read_engagement and pages_show_list. Iskaria does NOT have it yet: publish calls fail (Graph error 10 / 200-299) until Advanced Access is granted. | sensitive | testedm5m17 |
| pages_read_engagement | Read the Page's own posts and engagement; prerequisite for the posting and IG permissions | sensitive | testedm5m17 |
| instagram_manage_messages | Read and reply to the clinic's Instagram Direct messages Facebook Login path; needs instagram_basic, pages_read_engagement, pages_show_list. The Instagram Login path uses instagram_business_manage_messages instead and needs no linked Page. | sensitive | testedm5m11m17 |
| instagram_content_publish | Publish the clinic's organic Instagram feed posts Not yet held by Iskaria. Instagram Login equivalent: instagram_business_content_publish. | sensitive | testedm5m11m17 |
| whatsapp_business_messaging | Send and receive WhatsApp messages, media and templates for the clinic's number Depends on whatsapp_business_management. Needed for the Tech Provider path. Review video must show a message sent from the app arriving in WhatsApp. | sensitive | sourcedm5m6 |
| business_management | Read and manage the client's business portfolio assets (Pages, ad accounts, WABAs) via the Business Manager API Iskaria holds it. Request only if you truly manage portfolio assets; reviewers question it often. | sensitive | testedm5m17 |
What can slow you down or block approval
Meta reviews the whole submission in one pass. A broken privacy URL, test login, or a video that doesn't show the consent screen gets permissions rejected, and the resubmission waits the full cycle again. Developers report ~20 days per cycle in 2026; Meta's guide says about a week.
Workaround: Verify the business first. Make sure the reviewer test path works. Record each video from login to visible result on the day you submit.
Advanced Access is impossible without Business Verification. A legal name that doesn't match the documents, or a website without the legal entity in its footer, is a common cause of rejection.
Workaround: Fill legalEntity in the profile and make the iskaria.com footer show the same legal name.
After pages_manage_posts / instagram_content_publish are approved, each connected Page and IG account must reconnect through Facebook Login for Business. Until then publish calls fail with Graph error 10 or 200-299.
Workaround: Check granted scopes per token and show a 'reconnect to enable posting' prompt.
A client WhatsApp Business Account whose business verification sat at 'pending_submission' could not publish or send templates until the client verified their own business.
Workaround: Make client business verification part of onboarding, with the client's own documents.
Embedded Signup runs only on Allowed Domains with HTTPS, so localhost is out. The Tech Provider cannot onboard the portfolio that owns the app. Before Business Verification + App Review + Access Verification, the cap is 10 new customers per rolling 7 days; completing all three raises it automatically to 200, and more needs Meta Business Partner status.
Workaround: Test on a preview HTTPS domain with a separate test business portfolio.
In September-October 2026, developers reported Tech Provider Access Verification stuck 'In review' well past the 5 days shown, with support cases closed by an AI agent.
What we checked
| Claim | How | Result |
|---|---|---|
| Instagram posting/messaging always needs a Facebook Page link and instagram_content_publish / instagram_manage_messages True only for the Facebook Login path. Instagram API with Instagram Login uses instagram_business_content_publish / instagram_business_manage_messages and needs no linked Page. | Fetched Instagram Platform overview | corrected |
| Embedded Signup onboarding is capped at 10 new customers per 7 days until verification, then 200 | Fetched Embedded Signup overview | confirmed |
| App Review returns a decision within about a week Official guide says within a week. 2026 third-party reports say ~20 days per cycle, so treat a week as the best case. | Fetched Meta submission guide; compared with 2026 developer reports | unverified |
| A data deletion callback is mandatory Either a callback URL or a deletion instructions URL satisfies the requirement. Iskaria's instructions page is enough. | Fetched data deletion callback doc | corrected |
| Development mode limits permission requests to role users | Fetched App Modes and Access Levels docs | confirmed |
| Tech Provider Access Verification takes ~5 business days The dashboard states it, but several developers report 9+ business days. | Meta forum threads quoting the dashboard (Sep-Oct 2026) | unverified |
| Embedded Signup onboarding cap: 10 new business customers per rolling 7 days before Business Verification + App Review + Access Verification Added the raised limit (200 per rolling 7 days, automatic) to the blocker. | Independent check: re-fetched developers.facebook.com/docs/whatsapp/embedded-signup/ on 2026-10-30 | confirmed |
| App Review decision in about a week (Meta) vs ~20 days per cycle (developer reports) Meta: 'you should receive a decision within a week'. The 20-day figure is third-party only. If Meta cannot access the app, the entire submission is rejected; otherwise permissions are judged one by one. | Independent check: re-fetched developers.facebook.com/docs/app-review/submission-guide/ on 2026-10-30 | confirmed |
| OAuth endpoint behaviour (discovery metadata, PKCE, dynamic registration, unknown-client handling) Facebook's OIDC discovery only describes Limited Login (implicit id_token); no PKCE methods advertised, no dynamic registration. /v21.0/dialog/oauth with an unknown client_id returns HTTP 200 with an HTML error page. | Endpoint probe: node scripts/probe.ts on 2026-10-30 | confirmed |
- Review times: Meta says 'a decision within a week'; the ~20-day per-cycle figure and the 4-week Business Verification figure are anecdotal (2026 third-party posts).
- Exact use-case labels in the 2026 app dashboard for Instagram and WhatsApp were not confirmed in official docs this session; only 'Manage everything on your Page' was.
- Whether Business-type apps still show a Development/Live toggle in the use-case dashboard; Meta's app-modes page does not address Business apps specifically.
- Whether Iskaria's business portfolio is formally recorded as verified: profile says 'unknown' although Advanced Access implies it.
- Meta's WhatsApp docs are moving to developers.facebook.com/documentation/business-messaging/...; some older /docs/whatsapp deep links may redirect or 404.
- Whether https://iskaria.com/terms and /support are live was not checked.
Sources
- m1Access Levels (Graph API) · official-docs · accessed 2026-10-30
“Business Verification is required to get Advanced Access.”
- m2App Modes · official-docs · accessed 2026-10-30
“Apps in Development mode can only request permissions from role users.”
- m3
- m4Data Deletion Callback · official-docs · accessed 2026-10-30
“Developers need to specify either a data deletion callback instruction URL or a callback URL found in Basic Settings for your app.”
- m5Permissions Reference · official-docs · accessed 2026-10-30
“allows your app to create, edit and delete your Page posts.”
- m6Get Started for Tech Providers (WhatsApp) · official-docs · accessed 2026-10-30
“To become a tech provider you need to verify your business with Meta.”
- m7Embedded Signup overview · official-docs · accessed 2026-10-30
“By default, you can onboard up to 10 new business customers in a rolling 7-day window.”
- m8Embedded Signup implementation · official-docs · accessed 2026-10-30
“Only domains that have enabled HTTPS are supported.”
- m9Data Use Checkup · provider-policy · accessed 2026-10-30
“The Data Use Checkup is an annual assessment that evaluates whether”
- m10Data Use Checkup - Tutorial · provider-policy · accessed 2026-10-30
“will receive a developer notification in your email and Alerts Inbox 60 days before DUC is due”
- m11Instagram Platform overview · official-docs · accessed 2026-10-30
“Instagram API with Instagram Login serves Instagram professional accounts without requiring a linked Facebook Page.”
- m12Business Verification (app development) · official-docs · accessed 2026-10-30
“must be connected to a Business that has completed Business Verification”
- m13Create an App · official-docs · accessed 2026-10-30
“If your app will access data that you don't own or manage, you must connect your app to a business portfolio.”
- m14Meta developer forum: Access Verification stuck 'In Review' (Oct 2026) · community · accessed 2026-10-30
“Submissions typically take around 5 business days.”
- m16WoopSocial: Meta App Review Rejected? 2026 guide · community · accessed 2026-10-30
“roughly 20 days to go through a normal review”
- m17Iskaria's own Meta app, 2026 · our-test · accessed 2026-10-30
“App holds pages_messaging, pages_read_engagement, instagram_manage_messages/comments, ads_management, business_management; not pages_manage_posts or instagram_content_publish.”
- m18Endpoint probe, 2026-10-30 · our-test · accessed 2026-10-30
“openid-configuration: response_types_supported [id_token, token id_token]; no token_endpoint, no code_challenge_methods_supported, no registration_endpoint”