How to get a Long-lived User Token – permanent Facebook token

1. Why can't a Long-lived User Token refresh itself forever?

Many website administrators often expect to configure a Cron job to automatically call the Facebook API every day to renew the Token without ever needing manual intervention. However, according to Meta's (Facebook) security policies, this is impossible to achieve for a User Access Token:

• Long-lived User Tokens have a maximum lifespan cap of 60 days:
  The mechanism grant_type=fb_exchange_token of Facebook only allows upgrading from a short-lived Token (1 to 2 hours) to a long-lived Token (60 days). Facebook strictly prohibits using the automated API to refresh or continuously rotate this 60-day cycle without a manual re-login action from the user.
• Tokens expire when the 60-day cycle ends:
  Upon reaching the 60-day mark from the creation date, the User Token expires completely and the session is terminated.
• Errors that occur:
  Once the User Token is dead, any requests sent from the website/plugin will be blocked by Facebook and return an error message:

  Error validating access token: Session has expired...

  At this point, the system will not be able to automatically retrieve the new Page Token.

2. The true nature of Facebook Page Access Token (Permanent Type)

Unlike personal accounts, Facebook Page Access Tokens can completely achieve a PERMANENT status (Expires: Never) if you properly follow Facebook's token issuance hierarchy process:

• Short-lived User Token sinh ra Short-lived Page Token (only valid for 1 to 2 hours).
• Long-lived User Token when calling the endpoint /me/accounts will generate a PERMANENT Page Access Token (Never Expires).

Note: The “Never Expires” Page Token can be used continuously for years without requiring daily Cron refreshes. This token will only be invalidated in the following cases:

1. The token creator changes their personal Facebook account password.
2. The user actively removes or revokes the App's permissions in their Facebook Settings.
3. The creator's account is removed from the Administrator (Admin) role of that Fanpage.

3. Detailed 4-step guide to get a PERMANENT Facebook Page Token

You only need to perform this process exactly once by following these steps:

Step 1: Get Short-lived User Token from Graph API Explorer

1. Access the tool Facebook Graph API Explorer.
2. Under Meta App (top right corner), select the correct App you use to connect your website.
3. Under User or Page, select Get User Access Token.
4. Check all 4 mandatory permissions:
   • pages_show_list (view page list)
   • pages_read_engagement (read page interactions)
   • pages_manage_posts (post to pages)
   • pages_manage_engagement (manage comments on pages)
5. Click the button Generate Access Token and proceed to approve the permissions on your personal Facebook account.
6. Copy the newly generated Token code (this is the SHORT_TOKEN, valid for 1-2 hours).

Step 2: Switch to Long-lived User Token (60-day validity)

Open a new browser tab and access the following link (replace the values in curly brackets with your actual information):

https://graph.facebook.com/v20.0/oauth/access_token?grant_type=fb_exchange_token&client_id={APP_ID}&client_secret={APP_SECRET}&fb_exchange_token={SHORT_TOKEN}

The browser will return JSON data as follows:

{
  "access_token": "EAAG...",
  "token_type": "bearer"
}

Please copy the entire string located in access_token (the segment starting with EAAG...). This is the LONG_LIVED_USER_TOKEN with a 60-day limit.

Step 3: Extract PERMANENT Page Access Token

Use the LONG_LIVED_USER_TOKEN just obtained in Step 2 to call the following URL in your browser:

https://graph.facebook.com/v20.0/me/accounts?access_token={LONG_LIVED_USER_TOKEN}

The browser will return a list of all Fanpages you manage. Find the Fanpage you want to post to and accurately copy the string of characters located in the field access_token of that Fanpage.

Step 4: Check and Save to System

1. Access the tool Facebook Access Token Debugger.
2. Paste the Fanpage Token you just retrieved in Step 3 into the verification box and click Debug.
3. At the line Expires, if the system displays Never (or the expiration time is blank), your token has successfully achieved permanent status.
4. Paste this Token into the configuration box Facebook Page Access Token on your website and click Save settings.