If you've ever built a background cron service or a daemon application that queries Facebook Page insights, posts to Instagram automatically, or manages Catalog feeds, you have likely run into the dreaded **Token Expiration** wall.
By default, Facebook user access tokens expire after a few hours, and even "long-lived" tokens expire after 60 days. In the past, developers had to write complex token-refresh cron jobs, implement client-secret integrations, or store keys in secure cloud vaults like Azure Key Vault to prevent their background daemons from breaking.
Fortunately, there is a much simpler, production-ready solution: **Meta System Users**. By generating a system-user-scoped token, you can request a token that Never Expires, allowing you to run your internal scripts via basic environment variables without any third-party vault or complex refresh logic.
The Solution at a Glance
Instead of checking user logins and rotating refresh tokens via OAuth, you create a Meta System User in Facebook Business Suite, grant it asset access permissions, and generate a token with a 'Never' expiration date. You save this token in your backend .env file, and you're set.
Step-by-Step Guide to Generate a Permanent Token
Step 1: Set Up a Meta System User & Assign Assets
To create a system user, you need Admin access to the Meta Business Portfolio. This user acts as a programmatic daemon, decoupling the API access from any physical employee account.
- Go to the Meta Business Settings page.
- In the left-hand navigation menu, under the Users section, click on System Users. (Reference: How to Add System Users (Official Help)).
- Click the Add button, name your system user (e.g.,
admin), select the Admin System User role, and click save. - Under the system user settings dashboard, click Assigned Assets. Assign the target resources (e.g., Facebook Pages, Meta Apps, or Instagram accounts) that your app needs programmatic control over.
System Users management dashboard showing assigned Pages, Apps, and Instagram Accounts.
Step 2: Start Token Generation & Select App
Once your assets are assigned, you can generate the credentials:
- Click on the **Generate token** button located in your System User pane.
- In the overlay modal, choose the target application (e.g.,
deloitteorbpcl-india) to link with the credentials.
Selecting the target application for token generation.
Step 3: Set Token Expiry to Never
This is the most critical step to prevent token expiration warnings and failures:
- Under **When should the token expire?**, select the Never option.
Selecting 'Never' to generate a permanent access token.
Step 4: Assign Required Scopes
Select the specific permissions required for your app (e.g. instagram_basic, ads_read, business_management) and click **Next** to generate and copy your final token secure key.
Selecting the specific Graph API permission scopes.
Pros and Cons of Permanent System User Tokens
Pros
- Zero Token Maintenance: Eliminates the need to write cron jobs or refresh loops to keep credentials alive.
- Decoupled from Users: Unlike page tokens, these do not expire when an employee changes their password or leaves the business.
- Simple Deployment: No complex integration with cloud vault environments (like Azure Key Vault) is required. A simple local
.envfile is sufficient.
Cons
- Security Risk on Leakage: Because the token does not expire, if the token is leaked or committed to a public git repo, attackers retain permanent access until it is manually revoked.
- Admin Privileges Required: Only Business Manager Admins can create System Users and generate these tokens.
- Meta Policy Restrictions: Some advanced API scopes are restricted and cannot be generated using simple System Users without complete App Review approval.
Sources of Truth
To learn more about Meta's token architecture, read the official developer specifications and guides:
- Meta Docs: About Meta Business Suite System Users
- Meta Setup: Install Apps and Generate Tokens Guide
- Facebook Help Center: Add System Users to Business Portfolio
- Developer Discussion: StackOverflow: Permanent Token for Internal Daemon Apps
Key Developer & Operator FAQ
Can I revoke a permanent token if it gets compromised?
Yes. If your server environment is compromised or your token is leaked, you can revoke it instantly by clicking the Revoke tokens button in the System Users console next to the corresponding user account.
Do I need to implement refresh token rotation?
No. By setting the expiry to "Never", the generated access token acts as a permanent API key. There is no refresh token returned because none is required.
Simplify Your Meta Graph Integrations
VitableTech engineers custom API workflows, automated backend daemons, and system integrations. Leverage our open-source tools to streamline your production environments.
Contact VitableTech Today