Connect Meta with your own token

Before you start

A Meta business portfolio where you are an admin — the thing at business.facebook.com/settings. Meta used to call it Business Manager.
The ad account inside that portfolio. Adako lists every ad account your system user can reach, so an agency’s client account shared with your portfolio shows up too — but whether Meta lets your app change one it does not own depends on the access level Meta grants that app, and Meta’s own documentation does not say. If a change on a client account is refused, Adako names the reason; write to support with the ad account id and we will work it out with you. Reading, editing and pausing work on any ad account, but creating an ad needs a payment method on the ad account itself. A card on the business portfolio is only a shared pool, and Meta does not treat it as funding until you set it on the account under Billing & payments. Adako checks this before it creates anything, because Meta otherwise accepts the campaign, the ad set and the creative and refuses only the ad, leaving three objects behind.
A Facebook Page in the same portfolio. Ads have to run from a Page, so without one Adako can read your account but cannot create anything.
A Facebook account registered as a Meta developer. Registration is free.

You will move between two different Meta sites: developers.facebook.com for the app, and business.facebook.com/settings for the portfolio, the system user and the token. Keep both open in separate tabs.

1. Create the app

Open developers.facebook.com/apps and choose Create app.
App details. Give it any name — Adako is fine. The name is never shown to anyone but you.
Use cases. Tick the checkbox on the right of Create & manage ads with Marketing API, the first card in the list. Then Next. Not Create & manage app ads with Meta Ads Manager: despite the name, that one does not include Marketing API access.
Business. Pick the business portfolio that owns your ad account.
Requirements, then Overview, then create the app.

Done when: You land on the app dashboard, and the app switcher in the top left shows your app name.

2. Fill the two fields that block publishing

In the left sidebar open App settings → Basic and fill in:

Privacy policy URL — a page describing how your business handles data. If your site has one, use it: yoursite.com/privacy. If you do not have one, Adako can generate one for you at Accounts → Privacy policy URL: it gives you a link naming your business and your contact address, which is what you paste here.
Category — the dropdown near the bottom. Business and pages is the usual choice. Meta will not publish the app while this is empty.

Save. Leave App domains and User data deletion alone — neither matters for a token you generate yourself.

Done when: Both fields show your values after the page reloads.

3. Publish the app

In the left sidebar open Publish — it carries an Unpublished badge. The page lists what is still missing; once the privacy policy URL from step 2 is in, publish the app.

“Publish”, not “Live”

Meta used to call this switching the app mode to Live, and much of the internet still does. There is no mode toggle now: it is the Publish item in the left sidebar. No App Review is needed for ad accounts in your own portfolio.

An unpublished app cannot create ads

Reads work either way, so a connection made from an unpublished app looks healthy until the first ad fails with error 1885183. Publishing fixes it and the token stays valid — you do not have to generate a new one.

Done when: The badge next to Publish no longer says Unpublished.

4. Create the system user

A system user is a robot account that owns the token, so the token does not die when someone changes their Facebook password.

Open Business settings → Users → System users → Add.
Name it anything — Adako is fine.
Set System user role to Admin.

The role dropdown defaults to Employee

Change it to Admin. Employee can be made to work, but only if every asset below is assigned exactly right, and the failure arrives much later as a permission error on a write. Admin removes that whole class of problem.

Done when: The new system user appears in the list.

5. Assign the assets

With the system user selected, choose Assign assets. The dialog has three columns: asset type on the left, the assets themselves in the middle, and the permission toggles on the right. You have to do all three columns once per asset type.

Ad accounts. Click it in the left column, tick your ad account in the middle, then in the right column turn on Manage ad accounts, under Full access. The partial toggles above it are not enough to create ads.

Facebook Pages. Click it, tick your Page, then turn on Ads and Insights.

Apps. Click it, tick the app you made in step 1, then turn on the Full access toggle. Skipping this is the single most common mistake: without the app assigned, step 6 will not offer it.

Instagram accounts. Only if you want ads to run from an Instagram identity. Click it, tick the account, then turn on Ads and Insights — the same pair as the Page. Leave Full access → Everything off: it hands over the payment method, which Adako never uses.

A red “Missing permissions” means a half-finished asset type

Selecting an asset in the middle column does nothing on its own. If you tick assets but set no toggle, that asset type shows Missing permissions in red in the left column and Assign assets stays grey and unclickable. Go back to each flagged type and turn a toggle on. The button turns blue when every type is complete.

Done when: Assign assets is blue, the count at the bottom left reads 3 assets selected, and no type shows a red flag.

6. Generate the token

On the system user, choose Generate token and pick the app from step 1.
Set the expiry to Never. If you pick 60 days instead, Adako emails you a week before it lapses.
Tick ads_read, ads_management, business_management, pages_show_list, pages_read_engagement. To read lead forms and their submissions, also tick leads_retrieval, pages_manage_ads.
Generate, then copy the token immediately. Meta does not show it again — if you close the dialog you generate a new one.

The permission list is long and the search box filters it. Tick them one at a time and count before you generate: a missing permission means starting this step over.

Done when: You have a long string starting with EAA on your clipboard.

7. Paste it into Adako

Open Accounts, paste the token into the Meta Ads card and choose Connect with token. Adako checks with Meta that the token works, carries the required permissions and reaches an ad account, and stores nothing unless all three hold. The ad accounts it reaches are then listed — switch on the ones Adako may work on.

Adding an ad account later? Refresh accounts

An ad account created or shared with your system user afterwards does not appear on its own. The token stays valid: assign the account to the system user at Meta, then choose Refresh accounts on the Meta Ads card and the new account joins the list.

Leave App secret empty. You only need it if you switched on Require app secret in App settings → Advanced, and if you did, copy the secret from App settings → Basic and paste it alongside the token.

A token without the two lead permissions still connects. Everything except lead forms works, and the Meta Ads card names what to add.

Done when: The Meta Ads card lists your ad accounts.

If Adako refuses the token

What it says	What to do
Missing permissions	Step 6 again, with every permission ticked. You cannot add permissions to a token that already exists.
No ad account	Step 5: the ad account is not assigned to this system user, or only has partial access. It needs Manage ad accounts.
App secret required or wrong	Copy the secret of the app that issued the token, from App settings → Basic. A secret from a different app fails the same way.
Expired	Step 6 again with the expiry set to Never.
Connects, but creating an ad fails with `1885183`	The app is still unpublished. Step 3. The token stays valid.

Replacing and revoking

To swap tokens, open the Meta Ads tab on Accounts and paste the new one under Add another token. Disconnecting erases Adako’s copy but leaves the token valid at Meta, because it belongs to your app — to end it there too, open Business settings → System users, pick the user and revoke its tokens.

The token is encrypted on Adako’s servers and is never sent to your assistant. Adako calls the Marketing API as your service provider under Meta’s Platform Terms; see the Terms.