--- title: "Page permissions and tokens" description: "The Facebook and Instagram access AFP asks for on a connected page, what each grant enables, and why a page's stored access expires." canonical: https://docs.afp.monster/reference/page-permissions updated: 2026-08-19 pageType: reference --- AFP acts on a connected page with access that page's administrator grants. On Facebook that means an admin role on the page plus consent from the profile that administers it; on Instagram Business Login it means three permissions covering the account's business details, its comments, and its messages. Each grant is stored per page as an access token, and every action a campaign takes uses it. ## Summary | Grant | Where you approve it | What it enables | What breaks without it | |---|---|---|---| | Admin role on the Facebook page | On Facebook, in that page's settings | AFP asks Facebook for the page's own access token, which every action on the page uses | Facebook returns no page token and AFP refuses to link the page, reporting no admin access | | Page management, requested as `pages_manage_metadata` | Facebook's consent screen, when you attach a profile | Registering and removing the page's event subscription | Comments and messages never reach AFP, so nothing on the page triggers | | Instagram access, requested as `instagram_basic` | Facebook's consent screen | Reaching an Instagram business account attached to a linked Facebook page, through that page's token | The Instagram account attached to the page cannot be read or acted on | | `instagram_business_basic` | Instagram's consent screen, during Instagram Business Login | Reading the account's id, username, name, and profile picture, which is how AFP identifies what it connected | Business Login cannot complete and no account is connected | | `instagram_business_manage_comments` | Instagram's consent screen | Receiving comment events on the account and running comment actions on them | Comment triggers and comment actions fail on that account | | `instagram_business_manage_messages` | Instagram's consent screen | Receiving direct messages on the account and sending them | DM triggers never fire and no DM is delivered | ## Facebook page access - **Granted by:** the Facebook profile that administers the page - **Stored as:** one access token per connected page - **Renewed by:** AFP itself when a call is refused, or by re-authorising the profile AFP builds the list of pages you can link by asking Facebook which pages each attached profile administers. Linking then requests that page's own access token, and a page Facebook returns no token for is skipped rather than linked, reported as the profile having no admin access to it. A page's token is what publishes every action on that page: a public comment reply, a hidden or deleted comment, a direct message, and blocking a commenter. An Instagram business account attached to a linked Facebook page runs on the same Facebook page token instead of one of its own. When a call for a page's posts is refused, AFP rewrites that page's token from the owning profile's current access, re-registers the page's event subscription, and retries the call. A refusal that survives that retry is what surfaces as expired access. ## Instagram Business Login access - **Granted by:** the Instagram business account itself - **Stored as:** one long-lived Instagram token per connected account, valid for 60 days - **Renewed by:** a daily refresh pass, or by running Business Login again Instagram Business Login connects a business account with no Facebook page involved. AFP asks for three permissions on Instagram's consent screen — basic business details, managing comments, and managing messages — and stores the resulting long-lived token on the account. The consent link AFP creates is single use and expires ten minutes after it is issued. Cancelling on Instagram's screen, opening the same link twice, or returning after it expires all end with nothing connected. Use one route per Instagram account. An account AFP already reaches through a linked Facebook page is refused by Business Login, and an account connected by Business Login is not attached a second time when its Facebook page is linked later. ## Why access expires, and what you see | Symptom | What it means | |---|---| | A page on **Accounts** reads as expired | The access stored for that page no longer works | | A Facebook profile group reads as expired | The profile's own Facebook access no longer works, so every page under it is affected | | A profile's pages vanish from the available list | AFP asked Facebook for that profile's pages, was refused, and flagged the profile | | A notification saying an Instagram account's access expired | A scheduled refresh of that account's long-lived token failed permanently | Instagram Business Login tokens expire by design: they are long-lived rather than permanent, so an account whose refreshes keep failing eventually stops working. Facebook access carries no expiry date AFP can watch — a page or profile is flagged the first time Facebook refuses a call made with it. | Page type | How to restore access | |---|---| | A Facebook page, or an Instagram account reached through one | Refresh the owning profile's access. AFP sends you to Facebook to consent again and clears the expired flag when you return; the request is held for five minutes | | A standalone Instagram business account | Refresh that account's access. AFP sends you back through Instagram Business Login, which stores a fresh long-lived token | ## Automatic renewal Once a day AFP refreshes the long-lived token of every connected Instagram account that expires within the next seven days, a few accounts at a time. A refresh that fails because the authorisation is gone marks the account's access expired and sends a notification; a refresh that fails for any other reason leaves the account untouched to be retried on the next pass. Facebook page tokens are renewed on demand instead of on a schedule: the refusal of a call is what prompts AFP to re-derive the page token from the profile that owns it. [Notification catalogue](/reference/notifications) lists the notification an expired Instagram token sends and which channels it reaches. ## The page event subscription Events reach AFP only for a page whose event subscription is registered with the platform and verified. Verification is a handshake: the platform calls AFP with a challenge and a verify token, AFP echoes the challenge back, and events start flowing. A handshake whose token AFP does not recognise is refused, and the platform treats the subscription as unregistered. Registration is tied to campaigns rather than to linking. Creating the first campaign on a page registers that page's subscription, rebinding a campaign to a different page registers the new page as well, and deleting the last campaign on a page removes the subscription again. One subscription covers everything a campaign can react to on that page: comment activity on its posts, incoming messages, and button clicks inside those messages. ## Notes - The access stored for a page is never sent to the browser. AFP strips both the Facebook page token and the Instagram token out of every page listing it returns. - Access is per page, not per account. One expired page does not stop the other pages on the same account, though a Facebook profile group shows the worst status among its pages. - A profile whose Facebook access has expired keeps its linked pages. The pages stay on **Accounts**, flagged, and start working again once the profile is re-authorised. - Declining a consent screen changes nothing. The page or profile stays exactly as it was, still flagged. ## Related - [Connect a page](/start/connect-a-page) — the procedure for attaching a profile, linking its pages, and running Instagram Business Login. - [Trigger events](/reference/trigger-events) — the four events the page subscription delivers, and what each one carries into a campaign. - [Notification catalogue](/reference/notifications) — the page and token notifications AFP sends, and where each one goes. - [Why is my campaign not replying?](/start/troubleshooting) — how expired access looks in a campaign's execution history.