Facebook

Overview

Connect your users to Facebook for profile data, Page management, and social integrations via the Meta Graph API.

Property	Value
Provider ID	facebook
Category	Social
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Facebook OAuth App

Go to the Meta for Developers portal

Navigate to developers.facebook.com/apps and sign in.

Create a new app

Click Create App, enter the app name and contact email, then add the Authenticate and request data from users with Facebook Login use case (or another use case that includes Facebook Login).

Configure OAuth redirect URIs

In the app’s left menu open Facebook Login (shown as Facebook Login for Business on business apps) > Settings. Under Client OAuth settings, add the Alter callback URL from the Developer Portal to Valid OAuth Redirect URIs and save.

Get credentials

Go to App settings > Basic and copy the App ID (Client ID) and App Secret (Client Secret).

Warning

Never share the application Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Facebook provider

Go to OAuth Providers > Add Provider > Facebook.

Enter credentials

• Client ID: Paste your Facebook App ID
• Client Secret: Paste your Facebook App Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
public_profile	View the user’s basic profile information
email	View the user’s primary email address
pages_show_list	View the list of Pages the user manages
pages_read_engagement	Read content (posts, photos, videos) posted by the Page
pages_read_user_content	Read user-generated content on the Page
pages_manage_posts	Create, edit, and delete posts on the user’s Pages
pages_manage_engagement	Create, edit, and delete comments posted on the Page
pages_manage_metadata	Subscribe and receive webhooks about activity on the Page
publish_video	Publish live videos to a user’s timeline, group, event, or Page
instagram_basic	View the user’s Instagram account profile and media
instagram_content_publish	Publish media to the user’s Instagram professional account
instagram_manage_comments	Read and manage comments on the user’s Instagram media
instagram_manage_insights	View analytics and insights for the user’s Instagram account
instagram_manage_messages	Read and send Instagram Direct messages for the professional account
business_management	Manage the user’s business assets and settings

Notes

• Instagram and Facebook share the same Meta OAuth endpoints and App ID/Secret. If you configure both providers, they must use the same Meta app credentials.
• Some permissions (e.g., pages_manage_posts) require App Review before use in production.
• See the Facebook Login documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
page/feed/create	send	POST	/{page_id}/feed
page/photos/create	send	POST	/{page_id}/photos
post/comments/create	send	POST	/{post_id}/comments
node/delete	delete	DELETE	/{object_id}
page/subscribed_apps	admin	POST	/{page_id}/subscribed_apps
node/get	read	GET	/{object_id}
me/get	read	GET	/me
me/accounts	read	GET	/me/accounts
me/permissions	read	GET	/me/permissions
debug_token	read	GET	/debug_token
page/feed/list	read	GET	/{page_id}/feed
page/insights	read	GET	/{page_id}/insights
page/posts	read	GET	/{page_id}/posts
post/comments/list	read	GET	/{post_id}/comments
post/reactions	read	GET	/{post_id}/reactions