If you've connected a System User token, accounts show up fine, but every ad creation fails with Facebook error code #31, subcode 3858385 — this specific subcode has two confirmed causes. Check them in order.
Cause 1 (most common): the token was issued in Development mode
The System User token was issued while the Meta app was still in Development mode, not Live. That kind of token reads data fine — accounts, stats, Pages — but Facebook refuses to run ad-creation operations through it. The error text reads "authenticate your account," which is misleading — this isn't about login or token permissions, it's about the app's mode at the moment the token was issued.
Reading (accounts, statuses, stats) is almost always allowed by Facebook. Writing — creating campaigns, ad sets, ads — requires the app to already be officially in production mode (Live) at the moment the token was issued. Development mode exists for testing the integration, not for running real ads, and Facebook enforces that split at the token level, not just in the developer dashboard.
How to check and fix it:
- Confirm the app is currently Live (App Dashboard → App Mode).
- If the token was issued before that, switching modes afterward doesn't fix it. Generate a new System User token after Live (Business Settings → System Users → "Generate new token").
- Connect the new token in AdFleet — "Accounts" → "Connect token".
Cause 2: the token has no role in the account's owning BM
Even when the app has been Live from the start, the same subcode 3858385 shows up in another confirmed scenario: the profile/token has no role in the Business Manager that actually owns the account — only "Advertiser" access to someone else's account via partnership. Meta treats this as grounds for a security check (something like account-takeover protection), and the block extends to ad creation beyond just that one account.
How to check and fix it:
- The BM that owns the account adds you under "People" with a "Manage campaigns" role (not just partner access to the account).
- Or the BM owner triggers "Start authentication" themselves in Ads Manager.
- Same as Cause 1 — don't hammer the same token/requests repeatedly until you fix access or refresh the token: retries don't solve it, they just pile up more refusals.
The mistake people make trying to fix it
The most intuitive but wrong move in either case is to change just one thing (mode or role) and immediately retry the same launch with the same token. The token is bound to its state at the moment it was issued — if it was Cause 1, you need an actual new token, not a mode switch applied to the old one.
Full step-by-step guide for creating the app and token from scratch: System User Token Guide.
How to avoid this ahead of time
Switch your app to Live before the first time you generate any System User token (closes off Cause 1). Assign a "Manage campaigns" role in the account's owning BM, not just partner access (closes off Cause 2). Both are one-time setup, not something you redo per launch.