Facebook API integration for web and mobile apps

Meta's Graph API is the main way to read and write data on the Facebook platform, and Facebook Login lets people sign in to your app with their Facebook account. We build these integrations and the parts that make them dependable: permissions, App Review, token handling and version upgrades.

Talk through your Facebook integration Request an estimate

Sign in with Facebook next to other login options
Pages, posts and webhooks through the Graph API
Share dialogs on web, iOS and Android
App Review, tokens and version upgrades planned in

When the Facebook API is the right choice

The Facebook platform suits products that need to work with Facebook accounts or Pages:

You want sign-in with Facebook alongside other login options. Name and email are available without App Review.
Your app reads data that users agree to share, or manages Pages they administer, and the matching permissions can be approved.
You need to react to changes such as new comments on a Page. Webhooks notify you, so you do not have to poll.
Users should share links, photos or video from your app through the Share dialogs.

When the Facebook API is not the right choice

Plan around these limits before you commit:

Anything beyond public profile and email needs App Review before the public can use it. If review is not acceptable, use another sign-in provider.
Broad access to a user's friends or social data cannot be assumed. Permissions are granular and users can decline them.
Posting silently on a user's behalf is not something to assume. The Share dialogs are completed by the user.
Long-running background access with no user activity. User tokens expire, so plan for a Page token or a re-login.

What we build with the Facebook API

Typical projects, described in general terms.

Sign in with Facebook

Facebook Login on web, iOS and Android, tied to your own user accounts.

Pages and posting

Reading Page content and creating posts for the Pages a business manages, with the right permissions.

Webhooks

Notifications of changes on subscribed fields, so your app reacts without polling.

Sharing

Share dialogs for links, photos and video from your web and mobile apps.

App Review

Preparing the permissions, screencasts and privacy information Meta asks for, and testing in development mode first.

Version upgrades

Pinning the Graph API version and moving to a newer one before the old one lapses.

What the Facebook platform gives you

Meta describes the Graph API as the primary way to get data into and out of the Facebook platform. It is an HTTPS-only API built around nodes (objects with IDs), edges (the connections between them) and fields (their properties). Facebook Login supports web, iOS, Android and other platforms, and can be used for sign-in alone or with permission to access a person's data. The Pages API reads and updates Page content; publishing needs a Page access token and the right permission. Webhooks send HTTPS notifications when subscribed fields change. New apps start in Development mode, where only people with a role on the app can use permissions, and move to Live mode for the public.

What a Facebook integration needs beyond the API

Pin the API version: Graph API versions are released regularly and each stays usable for a limited period. After that, calls fall back to a newer version, so behaviour can change silently. We pin a version and plan upgrades.
Tokens: user tokens are short-lived by default, and long-lived ones last about 60 days. Long-lived Page tokens do not have an expiry date. We build the exchange and refresh steps, and handle expiry.
Revoked permissions: users can revoke access at any time, and unused permissions may expire. We check what is still granted before relying on it.
Data deletion: your privacy policy must explain how users can request deletion, and a deletion callback or instructions URL must be given to Meta.
Rate limits: calls are limited, and webhooks help you stay under them.
App Review: Meta does not promise a review time in its documentation, so we plan the launch without assuming a date.

How we work

Decide what you need from Facebook: sign-in, Pages, sharing or data, because each needs different permissions
Build in development mode: people with a role on the app can test every permission before review
Prepare App Review early: the permissions requested, how each is used, and a privacy policy that matches
Hand over properly: the app settings documented, the version pinned, and notes on token and permission handling

Frequently asked questions

Can we test before App Review?

Yes. In Development mode, people with a role on the app can use permissions and features without review. Review is needed once people outside the app's roles use it.

How long does App Review take?

Meta's documentation gives no figure, so we plan the launch without a promised date.

Will users stay logged in forever?

No. Long-lived user tokens last about 60 days and refresh when the app makes requests. Long-lived Page tokens have no expiry date. Users can also revoke access, so the app must handle that.

Does an API version keep working indefinitely?

No. Each version is supported for a limited time, and Meta may change an API sooner for security or privacy reasons. Plan periodic upgrades.