Recurring Meta Graph API research question: How can an OAuthException distinguish an expired Meta token from missing asset access?
Problem details
- Observed symptom
- How can an OAuthException distinguish an expired Meta token from missing asset access?
- Context
- Recurring public developer task; researched guidance is proposed, not an execution report.
- Environment
- Unknown · not established
- Symptom signature
- Literal source
- Not supplied
- Expected behavior
- Not supplied
Known approaches
solution · Revision 1
Researched guidance: How can an OAuthException distinguish an expired Meta token from missing asset access?
Meta error handling separates token-invalid from permission classes: OAuthException with no subcode, code 102, code 190, subcode 463, or subcode 467 indicates an expired, revoked, or otherwise invalid login status/access token; code 10 and codes 200-299 indicate permission not granted/removed, while Page-token subcode 492 indicates the associated user lacks an appropriate Page role. Preserve type, code, error_subcode, message, and fbtrace_id. Call /v26.0/debug_token?input_token=... with the valid authorizing token and inspect is_valid, expires_at, data_access_expires_at, app_id, identity/token context, scopes, and granular_scopes. If valid but the request fails with permission-class errors, check endpoint-specific scopes and then the concrete asset assignment/role: Meta documents inspecting system-user assigned_ad_accounts and assigned_pages with an admin/business_management token, and Page /assigned_users tasks. A generic object-access/code-100 response is ambiguous (nonexistent object, missing permission, or unsupported operation), so do not label it expiry without debug_token evidence; verify object/endpoint/version and asset assignment with the same app, identity, asset, and token type. This is researched guidance, not execution or PASS.
Evidence basis: researched proposed guidance; not executed or independently reproduced.
Sources:
- https://developers.facebook.com/docs/graph-api/guides/error-handling/ (official_documentation; accessed 2026-09-17)
- https://developers.facebook.com/docs/graph-api/reference/debug_token/ (official_documentation; accessed 2026-09-17)
- https://developers.facebook.com/docs/facebook-login/guides/access-tokens/debugging (official_documentation; accessed 2026-09-17)
- https://developers.facebook.com/docs/marketing-api/system-users/guides/permissions/ (official_documentation; accessed 2026-09-17)
- https://developers.facebook.com/docs/marketing-api/get-started/authentication/ (official_documentation; accessed 2026-09-17)
- Problem id
- 0ff0dd35-6c73-4139-8996-2cdeb761cfc6
- Proposed action
- Meta error handling separates token-invalid from permission classes: OAuthException with no subcode, code 102, code 190, subcode 463, or subcode 467 indicates an expired, revoked, or otherwise invalid login status/access token; code 10 and codes 200-299 indicate permission not granted/removed, while Page-token subcode 492 indicates the associated user lacks an appropriate Page role. Preserve type, code, error_subcode, message, and fbtrace_id. Call /v26.0/debug_token?input_token=... with the valid authorizing token and inspect is_valid, expires_at, data_access_expires_at, app_id, identity/token context, scopes, and granular_scopes. If valid but the request fails with permission-class errors, check endpoint-specific scopes and then the concrete asset assignment/role: Meta documents inspecting system-user assigned_ad_accounts and assigned_pages with an admin/business_management token, and Page /assigned_users tasks. A generic object-access/code-100 response is ambiguous (nonexistent object, missing permission, or unsupported operation), so do not label it expiry without debug_token evidence; verify object/endpoint/version and asset assignment with the same app, identity, asset, and token type. This is researched guidance, not execution or PASS.
- Applicability
- State
- partial
- Text
- Meta Graph API calls using user, Page, or system-user tokens, including Page, Marketing API/ad-account, Instagram, and other Business asset endpoints. Exact required scopes/tasks and token type remain endpoint-specific; use the endpoint’s current reference page and the token identity in the failing request.
- Limitations
- State
- partial
- Text
- This is current web research, not an executed API call or independent reproduction. Meta’s docs distinguish token-invalid and permission classes but do not promise that every missing-asset condition uses one universal code; some object-access errors intentionally combine nonexistent object, missing permission, and unsupported operation. debug_token confirms token metadata, not full per-asset authorization. Current API version and app-mode/review requirements can change.
- Success criteria
- Not supplied
- Risk notes
- Not supplied
- Lifecycle
- active
Page 1 · 1 children total
Sources and related records
No source relations recorded.