Meta Ads - Feature request: Facebook Login for Business (system-user tokens) for Meta connections

Ask

Let the Meta connect dialog run through Facebook Login for Business (FLB) with a login configuration minting a Business Integration System User token, instead of classic login with a personal user token.

Scope: our use is purely ads operations — campaign/ad-set/ad launch and management, structure + insights sync, Page-published ads, lead retrieval. No organic/posting.

Needed permissions: ads_management, ads_read, pages_manage_ads, pages_show_list, business_management, leads_retrieval.

Why

1. Employee turnover. The token belongs to whoever clicked "connect". They leave, get removed from the BM, or hit a password/2FA reset → sync and campaign management die while spend runs blind. A system-user token is installed into the business portfolio and survives staffing changes.

2. Personal-profile restrictions hit the business. Meta checkpoints/restricts personal profiles on personal signals (new device, ID verification, false positives). Acting through that profile's token makes personal risk the business's outage: live campaigns can't be paused or fixed. We built restriction detection + a guided re-verify flow because this recurs. With FLB the acting identity is the app's system user in the client's portfolio; API volume also attributes to the integration, not a person.

3. Multi-business isolation. One person often sits in 5+ Business Managers. Classic login stores grants per user + app: reconnecting client A silently rewrites the grant set for clients B–E (latest dialog wins — we run a fleet-wide health sweep to catch this), the token sees everything the person sees, and Page grants accumulate across all their clients. FLB grants are per business, picked in the dialog: per-client installations with their own asset lists, a real permission boundary, and per-business revocation from the client's own Business Settings.

FB API level

• App must be Business-type; create an FLB Login Configuration (token type: Business Integration System User; permission set above) in the App Dashboard.

• Dialog uses config_id instead of scope:

https://www.facebook.com/{api-version}/dialog/oauth
  ?client_id={APP_ID}
  &config_id={LOGIN_CONFIGURATION_ID}
  &redirect_uri={REDIRECT}
  &response_type=code
  &state={STATE}

• Business + asset (ad account, Page) selection is native to the FLB dialog.

• Token exchange is the same GET /oauth/access_token, but don't hard-require fb_exchange_token — system-user tokens are already long-lived and Meta rejects re-exchange; keep the initial token on rejection. (Verified live in our prior direct integration.)

• Discovery changes: /me is the system user, so /me/businesses returns []. Enumerate grants on the token: GET /me/adaccounts?fields=id,name,currency,business{id,name} (each account tagged with its owning BM); Pages likewise enumerate on the token.

• One-time app prerequisites: Advanced Access via App Review for the business permissions + a Data Deletion callback. FLB apps have reduced ongoing-review requirements.

Product asks

• Connect flow driven by an FLB config_id for the ads surface (per-workspace opt-in fine; posting can stay on classic login).

• Discovery/health endpoints that work on system-user tokens (no /me/businesses, no personal profile), token type surfaced so non-expiring tokens skip reconnect nagging.

• Migration: re-connect on an existing profile swaps the token in place, keeping scoped ad accounts and synced history.

References

• FLB: https://developers.facebook.com/docs/facebook-login/facebook-login-for-business

• Business Integration System User tokens: same doc, "Access token types"

• Data Deletion callback: https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback