Portal Community
BizFirstAI Portal / Nodes / Facebook / Authentication

Authentication

Facebook App setup, Page access tokens, and the credential vault

What you need: Every operation on this node needs a Page access token — a token scoped to a specific Facebook Page, obtained via a Facebook App with the right permissions. There is no separate "app ID / app secret" config on the node itself; the app is only involved in generating the token.

1. Create a Facebook App

  1. Go to developers.facebook.com/apps and create an app (type: Business).
  2. Add the Facebook Login for Business and Pages API products.
  3. Under App Review, request the permissions your workflow needs — see the table below.

2. Required Permissions by Operation

ResourceOperationsTypical Graph API Permission
pagepost, uploadImage/uploadVideo (via media)pages_manage_posts
pagegetFeed, getInfopages_read_engagement
pagegetInsightspages_read_engagement, read_insights
postcomment, updatepages_manage_engagement
postgetCommentspages_read_engagement
messagesend, getConversationspages_messaging
reactionsaddpages_manage_engagement
moderationhideComment, deleteCommentpages_manage_engagement

3. Generate a Page Access Token

  1. Use the Graph API Explorer (or an OAuth login flow in your own app) to obtain a User access token with the permissions above, tied to an admin of the target Page.
  2. Call GET /me/accounts with that user token — the response lists each Page the user administers along with a Page access token for it.
  3. Exchange the short-lived Page token for a long-lived one (Facebook's token debugger/exchange endpoint) so it doesn't expire every ~1-2 hours.
  4. Store the long-lived Page access token in the BizFirst.Ai credential vault.
Page tokens, not user tokens: A user access token cannot publish, read, or moderate on behalf of a Page. Confirm you're storing the Page token returned from /me/accounts, not the user token used to call it.

4. Configure the Node

The node resolves its Page access token in strict priority order:

  1. Vault (preferred): set credentialID in the node config to a vault credential registered under the alias "primary". The node reads it via ReadValuePrimaryAsync(isMandatory: false) and uses it if non-empty.
  2. Inline fallback: if the vault yields nothing, the node falls back to the plain pageAccessToken config field. This exists for local development only — never put a production token directly in a workflow definition.
FieldTypeSecret?Description
credentialIDint—Vault credential reference. Preferred way to supply the Page access token.
pageAccessTokentextYesInline fallback token. Development only.
pageIdtextNoFacebook Page ID. Not a secret — plain config, required by most operations.
MISSING_ACCESS_TOKEN: If neither the vault nor the inline field yields a token, every operation returns this error on the error output port before any Graph API call is made.

Token Validation

Before any network call, the node checks the token's shape locally: FacebookInputValidator.ValidateAccessToken rejects any token shorter than 100 characters — real Page access tokens are always longer than this, so it catches obviously wrong or truncated values early as FACEBOOK_AUTH_ERROR without spending a round trip to Graph.

Webhook Signature Verification (Infrastructure Only)

FacebookWebhookValidator exists in the Services layer and can verify an inbound webhook's X-Hub-Signature-256 header via HMAC-SHA256 against your Facebook App's App Secret. This is not yet wired into a node operation or HTTP endpoint — see Roadmap.