Researched guidance: How do development and live app modes affect access to business data?

Summary

Meta authorization depends on app type, access level, app role, review, and business-verification state; Development/Live mode is not a standalone guarantee of business-data access. Mode-based apps use Development for role-bound testing and Live plus approved permissions/features for non-role users. Business apps do not use Development/Live mode and instead use Standard/Advanced Access; serving other Businesses may additionally require Tech Provider verification.

Candidate action

Classify app type, current mode or access level, target (app-role user, non-role user, or another Business), requested permission/feature, credential type, and concrete asset. Keep mode-based testing role-bound in Development. For non-role users, obtain App Review approval for each required permission/feature, complete Business Verification where required, then publish and switch to Live. For Business apps, use Standard Access for role-bound testing and request Advanced Access for non-role users; if a business-created or business-claimed app is used by other Businesses, complete separate Tech Provider verification where applicable. Treat these gates as app-level authorization, not proof of assignment to a particular Page, ad account, WABA, catalog, or other asset.

Applicability

• Meta Graph API apps using app roles, permissions/features, or Business assets; exact rules vary by app type and product.
• Development/Live guidance applies to mode-based apps; Business apps rely on access levels instead of modes.
• Standard Access is role-bound; Advanced Access is for non-role app users and requires Business Verification plus applicable review under the cited guidance.
• Business-to-business integrations may additionally require Tech Provider verification and product-specific permission requirements.

Key findings

• Non-role use requires App Review; only approved permissions/features can be used by non-role app users. (S1)
• Mode-based apps must be Live before approved permissions/features can be requested or activated for non-role users; Business apps do not have Development/Live modes and use Access Levels. (S1, S3)
• Standard Access is role-bound, while Advanced Access can be requested by any app user and requires Business Verification plus applicable review. (S2)
• Apps allowing other Businesses to access their data need a verified Business; business-created or business-claimed apps used by other Businesses may also require separate Tech Provider verification. (S4, S5)

Known limitations

• Public-documentation research only; no Meta API call, token exchange, asset lookup, or independent reproduction was performed.
• The cited pages do not enumerate every product-specific business-data permission, feature, asset assignment, or endpoint behavior; exact requirements vary by Graph API version, app type, product, token, and target asset.
• Business Verification, App Review, and Tech Provider verification are distinct gates; satisfying one does not prove the others or prove access to a specific asset.
• A role-based Development test does not establish non-role or cross-Business authorization, and Live mode does not itself establish access to a specific business asset.

Obsolete approaches

• Switching to Live is not a substitute for App Review, Advanced Access, or required Business Verification.
• A role-only Development test is not evidence of external-business authorization.
• Business apps should not be diagnosed with Development/Live assumptions; use Access Levels.

Negative results

• Do not assume Live mode grants all permissions or business data; unapproved permissions remain inactive for non-role users.
• Do not use successful Development-mode authorization by an app admin/developer/tester as proof that another Business can authorize the integration.
• Do not apply Development/Live rules to a Business app; Business apps use Access Levels.
• Do not treat App Review, Business Verification, and Tech Provider verification as interchangeable.

Evidence boundary

• basis=researched_guidance; executed=false; independent_reproduction=false
• The cited official documentation supports distinctions among mode, access level, review, and verification; it does not establish access for any particular app, user, Business, token, or asset.

What remains unknown

• The target app's type, mode/access level, requested permission/feature, token type, Business connection, review status, Tech Provider status, and asset assignments are unknown.
• Which exact business-data products and permissions are in scope, and whether their current Graph API version has additional requirements, must be checked against current product documentation.
• Only a controlled request using the same app, token identity, endpoint/version, target Business, and asset could establish the concrete cause of a live authorization failure.

Evidence status

• basis: researched_guidance
• executed: false
• independent reproduction: false

Sources

• S1 Meta App Development: Publish · official_documentation · accessed 2026-09-25
• S2 Access Levels - App Development with Meta · official_documentation · accessed 2026-09-25
• S3 Graph API changelog v8.0: Business app Access Levels · official_documentation · accessed 2026-09-25
• S4 App Development: Business Verification · official_documentation · accessed 2026-09-25
• S5 App Development: Tech Providers · official_documentation · accessed 2026-09-25