{"id":297,"date":"2026-10-13T23:06:07","date_gmt":"2026-10-13T16:06:07","guid":{"rendered":"https:\/\/giaodienwp.net\/?p=297"},"modified":"2026-10-13T23:06:14","modified_gmt":"2026-10-13T16:06:14","slug":"huong-dan-lay-long-lived-user-token-token-facebook-vinh-vien","status":"publish","type":"post","link":"https:\/\/giaodienwp.net\/en\/huong-dan-lay-long-lived-user-token-token-facebook-vinh-vien\/","title":{"rendered":"How to get a Long-lived User Token &#8211; permanent Facebook token"},"content":{"rendered":"<h2>1. Why can't a Long-lived User Token refresh itself forever?<\/h2>\n<p>Many website administrators often expect to configure a Cron job to automatically call the Facebook API every day to renew the Token without ever needing manual intervention. However, according to Meta's (Facebook) security policies, this is <strong>impossible to achieve<\/strong> for a User Access Token:<\/p>\n<ul>\n<li><strong>Long-lived User Tokens have a maximum lifespan cap of 60 days:<\/strong><br \/>\nThe mechanism <code>grant_type=fb_exchange_token<\/code> of Facebook only allows upgrading from a short-lived Token (1 to 2 hours) to a long-lived Token (60 days). Facebook strictly prohibits using the automated API to refresh or continuously rotate this 60-day cycle without a manual re-login action from the user.<\/li>\n<li><strong>Tokens expire when the 60-day cycle ends:<\/strong><br \/>\nUpon reaching the 60-day mark from the creation date, the User Token expires completely and the session is terminated.<\/li>\n<li><strong>Errors that occur:<\/strong><br \/>\nOnce the User Token is dead, any requests sent from the website\/plugin will be blocked by Facebook and return an error message:<\/p>\n<blockquote><p><code>Error validating access token: Session has expired...<\/code><\/p><\/blockquote>\n<p>At this point, the system will not be able to automatically retrieve the new Page Token.<\/li>\n<\/ul>\n<hr \/>\n<h2>2. The true nature of Facebook Page Access Token (Permanent Type)<\/h2>\n<p>Unlike personal accounts, <strong>Facebook Page Access Tokens can completely achieve a PERMANENT status (Expires: Never)<\/strong> if you properly follow Facebook's token issuance hierarchy process:<\/p>\n<ul>\n<li><strong>Short-lived User Token<\/strong> sinh ra <strong>Short-lived Page Token<\/strong> (only valid for 1 to 2 hours).<\/li>\n<li><strong>Long-lived User Token<\/strong> when calling the endpoint <code>\/me\/accounts<\/code> will generate <strong>a PERMANENT Page Access Token (Never Expires)<\/strong>.<\/li>\n<\/ul>\n<p><strong>Note:<\/strong> The &#8220;Never Expires&#8221; Page Token can be used continuously for years without requiring daily Cron refreshes. This token will only be invalidated in the following cases:<\/p>\n<ol>\n<li>The token creator changes their personal Facebook account password.<\/li>\n<li>The user actively removes or revokes the App's permissions in their Facebook Settings.<\/li>\n<li>The creator's account is removed from the Administrator (Admin) role of that Fanpage.<\/li>\n<\/ol>\n<hr \/>\n<h2>3. Detailed 4-step guide to get a PERMANENT Facebook Page Token<\/h2>\n<p>You only need to perform this process exactly once by following these steps:<\/p>\n<h3>Step 1: Get Short-lived User Token from Graph API Explorer<\/h3>\n<ol>\n<li>Access the tool <a href=\"https:\/\/developers.facebook.com\/tools\/explorer\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Facebook Graph API Explorer<\/a>.<\/li>\n<li>Under <strong>Meta App<\/strong> (top right corner), select the correct App you use to connect your website.<\/li>\n<li>Under <strong>User or Page<\/strong>, select <strong>Get User Access Token<\/strong>.<\/li>\n<li>Check all 4 mandatory permissions:\n<ul>\n<li><code>pages_show_list<\/code> (view page list)<\/li>\n<li><code>pages_read_engagement<\/code> (read page interactions)<\/li>\n<li><code>pages_manage_posts<\/code> (post to pages)<\/li>\n<li><code>pages_manage_engagement<\/code> (manage comments on pages)<\/li>\n<\/ul>\n<\/li>\n<li>Click the button <strong>Generate Access Token<\/strong> and proceed to approve the permissions on your personal Facebook account.<\/li>\n<li>Copy the newly generated Token code (this is the <strong>SHORT_TOKEN<\/strong>, valid for 1-2 hours).<\/li>\n<\/ol>\n<h3>Step 2: Switch to Long-lived User Token (60-day validity)<\/h3>\n<p>Open a new browser tab and access the following link (replace the values in curly brackets with your actual information):<\/p>\n<pre><code>https:\/\/graph.facebook.com\/v20.0\/oauth\/access_token?grant_type=fb_exchange_token&amp;client_id={APP_ID}&amp;client_secret={APP_SECRET}&amp;fb_exchange_token={SHORT_TOKEN}<\/code><\/pre>\n<p>The browser will return JSON data as follows:<\/p>\n<pre><code>{\r\n  \"access_token\": \"EAAG...\",\r\n  \"token_type\": \"bearer\"\r\n}<\/code><\/pre>\n<p>Please copy the entire string located in <code>access_token<\/code> (the segment starting with <code>EAAG...<\/code>). This is the <strong>LONG_LIVED_USER_TOKEN<\/strong> with a 60-day limit.<\/p>\n<h3>Step 3: Extract PERMANENT Page Access Token<\/h3>\n<p>Use the <strong>LONG_LIVED_USER_TOKEN<\/strong> just obtained in Step 2 to call the following URL in your browser:<\/p>\n<pre><code>https:\/\/graph.facebook.com\/v20.0\/me\/accounts?access_token={LONG_LIVED_USER_TOKEN}<\/code><\/pre>\n<p>The browser will return a list of all Fanpages you manage. Find the Fanpage you want to post to and accurately copy the string of characters located in the field <code>access_token<\/code> of that Fanpage.<\/p>\n<h3>Step 4: Check and Save to System<\/h3>\n<ol>\n<li>Access the tool <a href=\"https:\/\/developers.facebook.com\/tools\/debug\/accesstoken\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Facebook Access Token Debugger<\/a>.<\/li>\n<li>Paste the Fanpage Token you just retrieved in Step 3 into the verification box and click <strong>Debug<\/strong>.<\/li>\n<li>At the line <strong>Expires<\/strong>, if the system displays <strong>Never<\/strong> (or the expiration time is blank), your token has successfully achieved permanent status.<\/li>\n<li>Paste this Token into the configuration box <strong>Facebook Page Access Token<\/strong> on your website and click <strong>Save settings<\/strong>.<\/li>\n<\/ol>","protected":false},"excerpt":{"rendered":"<p>1. T\u1ea1i sao Long-lived User Token kh\u00f4ng th\u1ec3 t\u1ef1 l\u00e0m m\u1edbi m\u00e3i m\u00e3i? Nhi\u1ec1u qu\u1ea3n tr\u1ecb vi\u00ean website th\u01b0\u1eddng k\u1ef3 v\u1ecdng c\u00f3 th\u1ec3 c\u1ea5u h\u00ecnh m\u00e3 Cron t\u1ef1 \u0111\u1ed9ng g\u1ecdi API Facebook m\u1ed7i ng\u00e0y \u0111\u1ec3 gia h\u1ea1n Token m\u00e0 kh\u00f4ng bao gi\u1edd c\u1ea7n thao t\u00e1c l\u1ea1i. Tuy nhi\u00ean, theo ch\u00ednh s\u00e1ch b\u1ea3o m\u1eadt c\u1ee7a Meta [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-297","post","type-post","status-publish","format-standard","hentry","category-huong-dan"],"_links":{"self":[{"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/posts\/297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/comments?post=297"}],"version-history":[{"count":0,"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/posts\/297\/revisions"}],"wp:attachment":[{"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/media?parent=297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/categories?post=297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giaodienwp.net\/en\/wp-json\/wp\/v2\/tags?post=297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}