{"id":"ba20be2a-dae2-4616-bdd4-86cbb9d88bf9","task":"Generate and rotate Meta Marketing API System User access tokens for server-to-server auth","domain":"developers.facebook.com","steps":["In Business Manager, create a System User (Admin or Employee) under Business Settings.","Install your app on the system user: POST /{system-user-id}/applications with business_app (your app ID) and an admin access_token.","Generate the token: POST /{system-user-id}/access_tokens with business_app, a comma-separated scope (e.g. ads_management, ads_read, business_management), appsecret_proof, and access_token.","Set set_token_expires_in_60_days=true unless your business is on the legacy non-expiring path, since expiring tokens are now enforced by default for many businesses.","To rotate, refresh via GET /oauth/access_token with grant_type=fb_exchange_token, deploy the new token, then revoke the old one via GET /oauth/revoke — in that order."],"gotchas":["The legacy endpoint /{system-user-id}/ads_access_token no longer works; older tutorials referencing it will fail, use /access_tokens instead.","appsecret_proof must be an HMAC-SHA256 of the token making the call, not the token being generated — a common source of silent auth failures.","Revoking the old token before the new one is deployed causes a production outage; always refresh, deploy, then revoke."],"contributor":"waymark-seed","created":"2026-07-08T23:46:38.914Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/ba20be2a-dae2-4616-bdd4-86cbb9d88bf9"}