Most modern Facebook scheduling tools handle authentication for you. You click "Connect Facebook" and they do the OAuth dance, store the token, and refresh it automatically. You never see the token.
But sometimes you need to manually generate a page access token. Maybe you are using a tool that requires it. Maybe you are testing something via the Graph API directly. Maybe you are debugging a token issue.
This post walks through how to do that in 2026, the gotchas to watch for, and when manual tokens are worse than OAuth.
When manual tokens matter
You need to generate a page access token manually when:
- A scheduling tool asks you to paste in a "page access token" rather than offering OAuth login
- You are calling the Facebook Graph API directly (for custom scripts, exports, or debugging)
- You are testing whether a Facebook permission actually works for your page
- A tool's OAuth flow is broken and you need a workaround
You do not need manual tokens when:
- A tool offers "Connect Facebook" via OAuth (use OAuth, it is safer)
- Meta Business Suite handles your scheduling
- A standard marketing tool is doing all your posting
If your tool offers OAuth, prefer OAuth. Manual tokens are a last resort.
Token types: a quick map
Facebook has three relevant token types:
User access tokens represent you. They expire quickly (about an hour for short-lived, 60 days for long-lived).
Page access tokens represent a specific page. They are derived from a user token. They can be permanent (never expire) if obtained from a long-lived user token.
App access tokens represent your Facebook app. They are server-side credentials, not for personal use.
For scheduling tools that ask for a "page access token", you want a long-lived page access token.
Step-by-step: getting a page access token
This walkthrough uses Facebook's Graph API Explorer. It is the official method.
Step 1: Open the Explorer. Go to developers.facebook.com/tools/explorer. Sign in with the Facebook account that admins your page.
Step 2: Select your Meta app. In the top right, select your Meta developer app. If you do not have one, you need to create one first at developers.facebook.com/apps.
Step 3: Generate a User Access Token. Click "Get Token" then "Get User Access Token". A permissions dialog opens.
Step 4: Grant the permissions you need. For page management, you want at minimum:
- `pages_show_list` (lets you see your pages)
- `pages_manage_posts` (lets you create posts)
- `pages_read_engagement` (lets you read page info)
For Reels you also want `pages_manage_posts` plus the Reels-specific permissions that apply to your app's review status.
Check the boxes. Click "Generate Access Token". Approve in the popup.
Step 5: Switch from User Token to Page Token. The token you just generated is a user access token. You need to swap it for a page access token.
In the Graph API Explorer, make a GET request to:
``` /me/accounts ```
The response is a JSON list of your pages. Each page entry includes the page name, the page ID, and a page access token.
Copy the `access_token` field for the page you want.
That is your page access token. Short-lived. Expires in about an hour.
Step 6: Convert to a long-lived token (recommended). Short-lived tokens are useless for scheduling tools. You need a long-lived token that lasts 60 days.
Make a GET request to:
``` /oauth/access_token?grant_type=fb_exchange_token&client_id={your-app-id}&client_secret={your-app-secret}&fb_exchange_token={short-lived-user-token} ```
Replace the placeholders. The response is a new long-lived user token.
Then redo Step 5 with this new long-lived user token. The page access tokens you get this time are permanent for as long as your app, your permissions, and your account remain in good standing.
You may also want our Find Your Facebook Page ID guide if you are setting up tools that need both pieces.
Storing tokens safely
A page access token is the equivalent of a password for that page. Anyone with the token can post on the page.
Treat it like a password:
- Do not paste it in chat messages, screenshots, or public forums
- Do not commit it to git
- Store it only in the tool that needs it
- Rotate it (regenerate) if you suspect exposure
If your token gets leaked, regenerate it immediately via the Graph API Explorer. The old token does not get invalidated automatically until you change your password, but the new one will work.
Common errors and what they mean
"Invalid OAuth access token" usually means the token expired. Generate a new one.
"Permission denied" means the token does not have the right scope. Re-generate with the correct permissions.
"Page not found" with a valid token usually means the page is owned by Business Manager and your token's user is not connected to the BM. Connect the user to the BM and retry.
"Token rate limited" means you hit an API call limit. Wait an hour and retry. Real apps need rate-limit handling. For one-off manual tokens this is rare.
When OAuth wins
Manual tokens are fine for testing, custom scripts, and small operations. They get painful at scale because:
- Long-lived tokens still expire eventually (60 days) and need regeneration
- Regenerating requires going back to the Explorer
- Each new permission scope requires re-generating
- Tokens are easy to leak if you have many of them in different places
Tools that handle OAuth properly do the refreshing automatically. You connect once and forget about it.
For multi-page operations specifically, OAuth is much cleaner. See our guide on running 5+ Facebook pages without burning out for the operational reasons.
Facebook Auto Poster uses OAuth for connecting pages. No manual token entry. The page tokens get refreshed automatically as part of the Facebook Login flow.
If you found this post because a tool you are evaluating requires manual token entry, consider whether that requirement signals the tool was built before OAuth was an option. Modern tools rarely make you do this.