Fresh 2026

Standard Operating Procedures

Step-by-step procedures distilled from the official Meta developer documentation. Each procedure is self-contained and links to the deeper reference pages in this site.

SOP 1, Register and configure a Meta app

1. Create a Meta developer account and verify it.
2. In the App Dashboard, create a new app and choose the use case (Business, Consumer, Gaming, etc.).
3. Note the App ID and App Secret (Settings → Basic). Never expose the App Secret client-side.
4. Add the products your app needs (Facebook Login, Marketing API, WhatsApp, Instagram, etc.).
5. Configure Valid OAuth Redirect URIs under Facebook Login → Settings.
6. Set the app to Development mode until it passes App Review, then switch to Live.

See App Development for the full dashboard reference.

SOP 2, Get a User Access Token (OAuth)

1. Redirect the user to the Login dialog with your client_id, redirect_uri, state, and requested scope (permissions).
2. Meta redirects back to your redirect_uri with a short-lived code.
3. Exchange the code for a short-lived User Access Token at the token endpoint with your client_id, client_secret, redirect_uri, and code.
4. Exchange the short-lived token for a long-lived token (~60 days) using grant_type=fb_exchange_token.
5. Inspect any token with the Access Token Debugger or the /debug_token endpoint to confirm scopes and expiry.

See Facebook Login and Graph API → Get Started.

SOP 3, Make your first Graph API call

1. Confirm the current API version (e.g. v25.0).
2. Call GET /{version}/me?fields=id,name&access_token={token}.
3. Use field expansion to fetch nested data in one request: ?fields=id,name,posts{message,created_time}.
4. Use batch requests to combine up to 50 calls into one HTTP request.
5. Handle paging via the paging.next / paging.cursors returned with edges.

See Graph API → Overview and Batch Requests.

SOP 4, Handle Graph API errors

1. Inspect the error object: code, error_subcode, message, fbtrace_id.
2. Map the code to a recovery tactic (re-auth on 190, back off on rate-limit codes 4 / 17 / 32 / 613).
3. Log the fbtrace_id, Meta support needs it to investigate.
4. Implement exponential backoff for transient and rate-limit errors.
5. For permission errors (200 / 10 / 803), re-request the missing scope.

See Graph API → Handle Errors.

SOP 5, Subscribe to Webhooks

1. Stand up an HTTPS endpoint that answers the verification handshake (hub.mode, hub.challenge, hub.verify_token).
2. In the App Dashboard, add the Webhooks product and subscribe to the object + fields you need (e.g. page, messages).
3. Validate each payload using the X-Hub-Signature-256 header against your App Secret.
4. Respond 200 OK quickly; process asynchronously to avoid retries.

See Graph API → Webhooks and Messenger Platform.

SOP 6, Submit for App Review

1. Build and test every feature in Development mode with test users.
2. Request only the permissions your app actually uses.
3. Provide a screencast and clear step-by-step reviewer instructions for each permission.
4. Complete Business Verification if a permission requires it.
5. Submit and monitor status; address rejections with the specific reasons given.

See App Review and Permissions.