Two kinds of tokens, and why it matters
Meta's Marketing API supports two authorization methods: a regular user token (tied to a personal Facebook account, lasts ~60 days) and a System User token (tied to a service account inside your Business Manager). For a tool that runs for months without your attention, the difference is critical: a user token needs renewing every couple of months; a system one doesn't.
Why a system token never expires
A System User isn't a person — it's a "robot employee" inside your Business Manager. It has no password to forget and no session that goes stale from inactivity. A token issued to it with expiry set to "Never" keeps working as long as the system user itself exists. It stops working in exactly three cases: you revoke it yourself, you delete the system user or the app, or Meta restricts the Business Manager itself.
How to get one, step by step
- Business Manager → Settings → Users → System Users → Add → any name → role Admin.
- On the system user → "Assign assets": the ad accounts and Pages you'll launch on, with full control (not view-only), plus your app with manage rights.
- "Generate new token" → your app → expiry Never.
- Tick 6 permissions:
ads_management,ads_read,business_management,pages_show_list,pages_read_engagement,pages_manage_ads. Without the last two you can't pick a Page or run on Instagram. - Copy the token (starts with
EAA) — Facebook shows it once.
A common mistake unrelated to the token itself
Even a correctly issued token won't create ads if the Meta app hadn't been switched to Live mode yet when it was generated — a separate, very common problem, covered with the exact error code in "Facebook Error #31/3858385".
What to do when you add new accounts later
No need to generate a new token — just assign the new accounts/Pages to the same system user (step 2); the token keeps working for those too.