Meta's permission screen and the permissions requested

Meta's permission screen and the permissions requested · Help

When you press a connect button you leave {{brand.name}} and land on Meta's own screen. There you meet a list of permissions written in technical names, and most people approve it without knowing what they granted. This article explains what happens on that screen and which job in the panel each permission unlocks.

What happens on Meta's side

The order is always the same:

The panel opens a connection session. It carries who you are, which portfolio you're connecting to, and whether you're renewing an existing account. It is signed and valid for 15 minutes.
You go to Meta's permission screen. Instagram's on the Instagram path, Facebook's on the Facebook path, and Meta's setup window for WhatsApp.
You approve. Meta hands {{brand.name}} a single-use authorization code. That code cannot read messages; it is only exchanged in the next step.
The panel exchanges the code for an access token. The token is stored encrypted on the server; it never appears on any screen, in any log or in any error message.
The panel reads the account's identity. On Instagram: username, name and profile picture. On WhatsApp: the number's approved name and the readable phone number.
The panel sets up the event subscription. From then on Meta pushes new messages to us; how that works is covered in What a webhook is.
The account opens and your inbox starts working.

⚠️ Note: If one of these steps fails, no half-written record is left behind. The panel sends you back to the connect screen with the reason.

How to read the permissions

Meta grants permissions at connection time, and the token carries only what was requested at that moment. That has two consequences:

If you withhold a permission, that feature doesn't work. No red error appears in the panel; the section quietly stays empty or says "waiting for permission".
A permission for a feature added later is not in the old token. In that case you have to reconnect the account once; an old token never widens by itself.

Permissions requested on the Instagram path

instagram_business_basic — Reads the account's identity: username, display name and profile picture. Without it the account shows up unnamed in lists.

instagram_business_manage_messages — Receives DMs and sends replies. Quick replies, button taps, read receipts and reactions also come through it. It is the foundation of the inbox and of every automation step that sends a message.

instagram_business_manage_comments — Reads post and reel comments, replies to them, sends private replies, and hides or deletes comments. The comment trigger and the comment actions rely on it. Mentions also arrive inside this notification.

instagram_business_manage_insights — Reads account and post insights. Without it the Insights section finds no data.

instagram_business_content_publish — Publishes and schedules posts from the panel. Without it, jobs in the Publishing section stay in the "waiting for permission" state.

Permissions requested on the Facebook path

This path asks for both Instagram and Page permissions, because every request runs through the Page.

instagram_basic — Reads the Instagram account's identity (the Page-path counterpart of the basic permission above).

instagram_manage_messages — Receives and answers Instagram DMs through the Page.

instagram_manage_comments — Reads, replies to, privately answers, hides and deletes Instagram comments.

instagram_manage_insights — Reads Instagram insights.

instagram_content_publish — Publishes posts to Instagram.

pages_show_list — Reads the list of Pages you manage. The candidates on the selection screen are found with it; without it no candidate appears on return.

pages_manage_metadata — Subscribes the Page to event notifications. This is the permission that makes messages arrive in the panel; without it the account connects but no message ever comes.

pages_read_engagement — Reads engagement on the Page.

pages_messaging — Sends messages through the Page.

business_management — Reads the Meta business portfolio the account belongs to.

Permissions requested for WhatsApp

whatsapp_business_messaging — Receives and sends WhatsApp messages, including template sends.

whatsapp_business_management — Manages the business account and the number: reading and writing the business profile, pulling the template list, reading the number's quality rating and tier, and setting up the event subscription all happen with it.

The two callbacks you give Meta

You don't see them on the permission screen, but they are part of the connection:

Deauthorization. When you remove the app's permission on Meta's side, Meta tells us and every account connected by that Meta user drops in the panel too. The card says "The app permission was removed on Meta".
Data deletion. When you send a data deletion request through Meta, the connection is cut first, then those accounts' contacts, conversations and events are deleted. A tracking code is returned to Meta.

A concrete example

You own a boutique and connect your account through the Instagram path. On the permission screen you decide the "insights" item is unnecessary and switch it off. The connection works fine, DMs arrive, automations run. Three weeks later you open the Insights section and see no numbers at all. There's no error message either. The reason is simple: that permission isn't in your token. The fix: renew the permissions from the account's Connection page and approve the whole list this time.

Common mistakes and how to fix them

Withholding a permission you think you won't use. You may not use it today, but you will tomorrow — and that day you'll have to reconnect the account. Grant them all.
Waiting a long time on the permission screen. The session drops after 15 minutes and you get "The connection session is invalid or expired".
Skipping the Page permissions on the Facebook path. With the Page subscription permission off, the account looks connected but not a single message arrives; this is the most time-consuming mistake of all.
Saying "I granted everything and still no messages". If the permissions are complete, the next suspect is Meta's approval status; see The Meta app and App Review.

If a section stays empty although you granted the permissions, see When a connection breaks or contact our Support team.