Meta App Review requirements: the checklist to go live

Meta App Review requirements start with one question: whose accounts will your app serve? Meta's own Instagram guides say Standard Access covers professional accounts you own or manage and have added to your app in the App Dashboard, while accounts you don't own or manage need Advanced Access, which Meta has to approve.

This checklist is part of Meta API use cases: which one your app needs. It uses only what Meta publishes on GitHub (its sample apps, Postman collections and SDK source) and the Meta entries in our API changelog. Meta's review rules change, and the full list for your app is in the App Dashboard. Use this page as the minimum to check; the dashboard has the rest.

What this means for you

A tool built for your own Instagram account or Facebook Page may never need Advanced Access. Meta's guides say Standard Access is enough for accounts you own or manage and have added to the app.

A tool that other businesses sign up for is different. It needs Advanced Access for the permissions it uses on their accounts. Until it has that, Meta's samples show it working only for people who have a role on the app.

The details

Meta App Review requirements, in order

1. Create the app as a Business app.
2. Fill in the app's basic settings.
3. Test with people who have a role on the app.
4. Sort each permission into Standard or Advanced Access.
5. Check whether your features need a verified business.
6. Apply in App review, Permissions & Features.
7. Confirm which permissions are approved.
8. Keep redirects, webhooks and the API version current.

Start with a Business app

The Instagram Platform collection opens with the setup: "To interact with the API, you must first have a Facebook App", and "for the purposes of the guide, we recommend using a Business App." The use case hub covers which use case to add to that app. If you're building for Instagram, Instagram Login or Facebook Login explains which login to pick, because the permissions you'll submit depend on it.

Development Mode: who can see the app

Meta's samples describe a Development Mode in which an app's features reach only the people attached to it. The Messenger collection says that for "Apps in Development Mode, the Messenger Profile settings will only be visible to people with role on the app."

Testing works the same way. The Instagram messaging notes say your app testers must:

• have a role on your app;
• grant your app access to all the required permissions;
• have a role on the Instagram professional account that owns the app.

Meta's older Original Coast Clothing sample also lists Instagram accounts "registered as test accounts" among the things you need before you start. The samples don't spell out the switch to live mode or what it changes, so read that part in the App Dashboard.

Standard Access or Advanced Access

This is the line that decides whether you need to apply. Meta's collections draw it like this:

The Instagram wording appears in five places in Meta's collection, for comments, messaging, insights and media. The Conversations API notes also say one limitation "will be resolved when your app has been approved for Advanced Access", which is how the samples describe it: something Meta approves, permission by permission.

Our sources don't say how Standard Access is granted or whether every permission has both levels. Some third-party guides also report that Meta has renamed access tiers for some APIs. Check the names and levels the App Dashboard shows for your app.

Business verification: when the samples ask for it

The clearest line in Meta's samples is in the Conversations API requirements: "Your app must be owned by a verified business." So the business is what gets verified, and the app has to belong to that business.

The samples don't say which other permissions need a verified business, or whether verification has to be finished before you can apply. If any feature you plan to use asks for it, start verification before you need it.

Apply in App review, Permissions & Features

App Review covers features as well as permissions. Meta's Instagram messaging notes say apps apply for the Human Agent permission "via the Developer App dashboard", under App review > Permissions & Features > Human Agent. They add that apps already approved for beta access to Human Agent "do not need to re-apply".

Ask only for what your app uses. Every permission or feature on the list is one more thing to explain and test.

What Meta's GitHub sources don't describe:

• what a submission must contain (written explanations, recordings, test logins);
• how long review takes;
• whether approved access is checked again later.

Those rules sit in the App Review section of the App Dashboard and change over time. Read them there for each permission before you submit.

Check which permissions are approved

Meta's Python Business SDK has a call that lists an app's permissions (GET /{app-id}/permissions) and filters them by status, with two values: live and unapproved. It's a quick way to confirm, after review, which permissions your app can use with people outside your team.

Settings to fill in

Meta's Original Coast Clothing sample lists "A Facebook App with Basic settings configured" as a requirement. The app object in Meta's Business SDK shows what those settings hold, including:

• privacy_policy_url and terms_of_service_url;
• icon_url, category and subcategory;
• contact_email and user_support_email;
• app_domains;
• deauth_callback_url.

The SDK lists fields. It doesn't say which ones App Review requires, and our sources don't describe Meta's data deletion setting. The Basic settings page in the App Dashboard shows what your app is missing.

Meta's Threads sample adds rules for redirect URIs. It says to add your redirect URL "to your app's redirect callback URLs in the app dashboard". It warns that Threads apps "do not support redirect URLs with using localhost" and that "OAuth redirects are only supported over HTTPS". It also says the Threads API has its own app ID and secret, which "ARE not the same as the regular app ID and app secret".

Webhooks: verification and signatures

If your app receives webhooks, Meta's Messenger collection describes two checks.

The first is the verification request. When you configure Webhooks in the App Dashboard, Meta sends a GET request to your endpoint with hub.mode (always subscribe), hub.verify_token and hub.challenge. Your endpoint checks that the token matches the one you set and responds with the hub.challenge value.

The second is the payload signature. Meta signs every notification with a SHA256 signature in the X-Hub-Signature-256 header, preceded by sha256=. You generate the same signature from the payload with your App Secret and compare the two. Meta says you don't have to validate it, "but you should and we strongly recommend that you do."

Some of Meta's older samples still read the SHA-1 X-Hub-Signature header. Use the SHA256 header in new code. Webhook endpoints that check Meta's client certificate also had to trust a new Meta-owned CA from March 31, 2026: see webhook mTLS certificates move to a Meta CA.

After approval: keeping access

Approved access is still bound by Meta's platform policies. Meta's sample code states that condition in its licence: use of the Threads sample "is subject to the Facebook Platform Policy", and the Messenger samples name the "Facebook Developer Principles and Policies". Read the current policies in the App Dashboard, because their names and contents change.

The Graph API version your app calls also expires. Meta Graph API versions lists every end date, and v21.0 is removed on January 21, 2027.

What to do next

• Business owners: If a developer builds a tool only for your own accounts, ask whether Standard Access covers it. Meta's guides say it can for accounts you own or manage, but nobody outside your team will be able to connect.
• Marketers and agencies: Before you sign clients up to a new tool, ask whether it has Advanced Access for the features you need. Without it, Meta's samples show the tool working only for people with a role on the app.
• Developers: Create a Business app, add testers with roles, and list each permission with the Standard or Advanced Access it needs. Start business verification early if any feature asks for it, then read the App Review requirements in the App Dashboard for each permission before you submit.