FIRST-TIME SETUP

Connect your Facebook Pages

You do this once, then repeat the final Graph API Explorer step whenever you create a new Page or need to refresh access.

Before you start: Sign in to Meta using the Facebook account that has full control/admin access to the Pages you want to schedule.

1. Create a Meta Developer app

Open Meta for Developers → My Apps, choose Create App, and name it something easy to recognize, such as “PostScheduling Access”.

2. Select “Manage everything on your Page”

In the app creation wizard, choose Content management, then select Manage everything on your Page.

3. Add the three Page permissions

Inside the use case permissions screen, add:

pages_manage_posts — allows the app to create/schedule Page posts.
pages_read_engagement — lets the app read Page content and verify scheduled items.
pages_show_list — lets Meta return the Pages your Facebook account manages.

4. Open Graph API Explorer

Go directly to Meta Graph API Explorer. Select the Meta app you just created, choose a User Token, add the same three permissions, and generate the access token.

Never send your access token to another person in chat or email. Paste it only into your own PostScheduling Connect Pages screen.

5. Retrieve all Pages you manage

In Graph API Explorer, run this request:

/me/accounts?fields=name,id,access_token,tasks

Click Submit. Meta returns your Page names, IDs, Page access tokens and tasks. Copy the entire JSON response and paste it into PostScheduling → Connect / Update Pages.

How access tokens are handled

Meta access tokens are not the same as your Facebook password. They are scoped keys that only carry the permissions Meta grants to the app.

Your Facebook password and 2FA code are never collected by PostScheduling.
If you paste a User Access Token for Page discovery, the service uses it to request your Page list and does not intentionally persist that User Token.
Page Access Tokens are required for future scheduling and management. Those tokens are encrypted with AES-GCM before being stored.
The encryption key is kept separately as a Cloudflare Worker Secret, not inside D1.
Page tokens are decrypted inside the Worker only to perform an action you requested, such as schedule, reschedule, cancel, or query Facebook scheduled posts.
The dashboard never displays your stored Page token back to you, and the application code does not intentionally log it.

Important: Because a Page token is what authorizes the scheduling API call, the backend must technically be able to use that token for the scheduling actions you request. No service can truthfully claim it “cannot use” a token while also using that token to publish on your behalf.