A complete, official, Meta-compliant guide to connecting a client's Facebook Page to an n8n automation system — using only the Messenger Platform API and Webhooks. No passwords, no browser automation, no unofficial access, at any step.

---

📌 Table of Contents

• 🏗️ Architecture
• 🔒 Security & Compliance
• 🛠️ Stack
• ✅ Prerequisites
• Part A — Business Portfolio Setup
• Part B — Create a Meta Developer Account
• Part C — Create the App & Select Use Case
• Part D — Permissions, Page Connection & Access Token
• Part E — Verifying the Token Type
• Part F — Creating & Hosting a Privacy Policy
• Part G — Configuring the Webhook
• Part H — Connecting the Webhook to Automation Logic
• Part I — Publishing the App (Going Live)
• Part J — Testing & Troubleshooting
• 📋 Credentials Checklist Template
• 👤 Author

---

🏗️ Architecture

Layer Overview

Layer	Components
User	End user sends a message on the client's Facebook Page
Facebook Page	Receives & replies via Messenger — connected to a Business Portfolio & App
Messenger Platform	Meta's official Messenger API — delivers incoming messages, sends outgoing replies
Automation System	n8n — receives the webhook, runs AI/DB/API logic, prepares & sends the reply
External Services	AI/LLM, Database, External APIs, or other tools the workflow calls

---

🔒 Security & Compliance

• ✅ Official Meta APIs only — Graph API + Messenger Platform
• ✅ No passwords, no bots, no browser automation
• ✅ Webhooks + Page Access Token — the only credentials involved
• ✅ Standard Access — no App Review or Business Verification needed, as long as the App and Page belong to the same Business Portfolio and serve only that one client

⚠️ App Review is only required when one App messages Pages that are not owned by its own Business Portfolio (e.g. one shared App serving multiple unrelated third-party clients). For a single-Page, single-client setup, Standard Access is sufficient.

---

🛠️ Stack

Component	Role	Purpose
Meta Business Portfolio	Container	Owns the client's Page + App together — enables Standard Access
Meta Developer Account	Access	Required to create and manage the App
Meta App (Business Messaging)	Bridge	Connects the Page to the Messenger Platform API
Graph API — Page Access Token	Credential	Authenticates all Send API requests
Webhook (GET + POST)	Trigger	Meta's verification handshake + incoming message delivery
n8n	Automation Engine	Receives the webhook, runs workflow logic, sends replies via the Send API
Privacy Policy (public URL)	Compliance	Required before the App can go Live

---

✅ Prerequisites

• A Facebook account with Admin access to the client's Facebook Page
• The client's Facebook Page must already exist
• A running automation system (e.g. n8n) reachable via a public HTTPS URL (VPS + domain, or VPS + ngrok/Cloudflare Tunnel for testing)
• A web browser (Chrome recommended)

---

Part A — Business Portfolio Setup

A Business Portfolio (formerly "Business Manager") is Meta's container for organizing Pages, Apps, and other business assets under one account. Every Page used for API-based messaging should be linked to a Business Portfolio that also owns the App — this is what allows Standard Access (no App Review) to work.

A.1 — Creating a New Business Portfolio (if the client doesn't have one)

1. Go to business.facebook.com and log in with the Facebook account that manages the client's Page.
2. If no portfolio exists, click "Create a Business Portfolio" (or "Create Account").
3. Enter the Business Portfolio name (matching the client's public business name), your name, and a business email address.
4. Click "Submit" / "Next".
5. Check the business email inbox and click the confirmation link Meta sends.
6. Optionally add team members or partners with the appropriate role (Admin, Employee, Partner, or System User).
7. Click "Confirm" to finish.

ℹ️ For a new client, repeat these steps using the client's own business details.

A.2 — Adding the Client's Existing Page to the Portfolio

1. Inside the Business Portfolio, go to "Business Settings" (gear icon).
2. In the left menu: "Accounts" → "Pages".
3. Click "+ Add" → "Add a Page".
4. Enter the Page name or URL and click "Add Page".
5. If you're an Admin of the Page, ownership is confirmed automatically or after Facebook's verification.

⚠️ This Page must stay linked to this same Business Portfolio for the entire setup — Standard Access permissions depend on this Page–Portfolio–App relationship.

---

Part B — Create a Meta Developer Account

1. Go to developers.facebook.com.
2. Log in with the same Facebook account used for the Business Portfolio.
3. If prompted, register as a developer (accept terms, verify with a phone number/SMS code).
4. Once registered, you'll land on the "My Apps" dashboard.

---

Part C — Create the App & Select Use Case

1. From "My Apps", click "Create App".
2. On the "Use cases" screen, click the "Business messaging" filter on the left panel.
3. Select "Engage with customers on Messenger from Meta" as the use case. Do not select WhatsApp or Threads unless specifically needed.
4. Click "Next".
5. On the "Business" step, select the Business Portfolio that owns the client's Page (from Part A).
6. Complete the "Requirements" step (App name, etc.) and continue to "Overview".
7. Click "Go to Dashboard" / "Create App" to finish.

The App Dashboard will show a checklist: "Customize the Engage with customers on Messenger from Meta use case", "Test use cases", and "Check requirements & publish".

---

Part D — Permissions, Page Connection & Access Token

D.1 — Reviewing Permissions

1. Click "Customize the Engage with customers on Messenger from Meta use case" from the Dashboard.
2. Go to the "Permissions and features" tab.

Because the Page belongs to the same Business Portfolio as the App, these should already show "Ready for testing" automatically:

• pages_messaging
• pages_manage_metadata
• pages_show_list
• business_management
• public_profile

⚠️ Do not click "Request permission" / submit for App Review at this stage. App Review is only needed when messaging Pages not owned by this Business Portfolio. For this single-Page, single-client setup, Standard Access is enough.

D.2 — Connecting the Page and Generating the Access Token

1. Go to the "Messenger API Settings" tab.
2. Under "2. Generate access tokens", click "Connect".
3. In the popup, select the client's Facebook Page and approve all requested permissions.
4. Once connected, the Page appears in the list with a "Generate" link next to "Token".
5. Click "Generate", then copy the full access token string.

⚠️ Store this token immediately in a secure location (password manager or the automation system's encrypted credentials store). Never hardcode it in code or share it in plain text.

---

Part E — Verifying the Token Type (Expiry Check)

Tokens generated through a Business-type App connected to a Business Portfolio are typically long-lived Page Access Tokens that don't expire — but always verify.

1. Open a new tab: developers.facebook.com/tools/debug/accesstoken
2. Paste the copied access token into the "Access Token" field.
3. Click "Debug".
4. Check the "Expires" field:

Expires Field Shows	Meaning	Action
Never	Permanent token — won't expire	No action needed. Proceed to webhook setup.
A specific date (~60 days)	Long-lived but temporary token	Convert to a System User token in Business Settings for a permanent token, or set a reminder to regenerate before expiry.

---

Part F — Creating & Hosting a Privacy Policy

Meta requires a publicly accessible Privacy Policy URL before an App can go Live. It must be a genuine page describing what user data is collected and how it's used — not an internal tool link or webhook URL.

F.1 — Writing the Policy

At minimum, describe:

• What data is collected (name, profile picture, PSID, message content)
• Why it's collected (customer support, order status, lead handling)
• Whether data is shared with third parties (e.g. AI providers like OpenAI/Anthropic, if applicable)
• How long data is retained and how it's protected
• How a user can request data deletion, and contact information

F.2 — Hosting the Policy Publicly

Any of these free options work:

• Notion — create a page, paste the policy text, then "Share" → "Publish" for a public *.notion.site URL
• Google Sites — build a simple one-page site and publish it
• GitHub Pages — host a static HTML page (most reliable, recommended for production)
• The client's own website, under a /privacy-policy path, if available

⚠️ Always test the final published URL in an incognito/private window to confirm it's viewable without logging in — this is exactly how Meta's review system checks it.

---

Part G — Configuring the Webhook

G.1 — Preparing the Automation System (n8n) Side

1. In n8n, create a new workflow and add a Webhook node.
2. Set the HTTP Method to accept both GET (Meta's verification handshake) and POST (incoming messages). Use the same Path for both if separate nodes are required.
3. Add a "Respond to Webhook" node after the Webhook node.
4. Configure the response: Respond With = Text, Response Body = the expression returning the incoming hub.challenge query parameter, Response Code = 200.
5. Save the workflow and toggle it Active.
6. Open the Webhook node and copy the Production URL (not the Test URL) — it only works while the workflow is Active.

G.2 — Configuring the Callback URL in Meta

1. In the Meta App Dashboard: Messenger API Settings → "1. Configure webhooks".
2. Paste the n8n Production URL into "Callback URL".
3. Enter a custom "Verify token" — any random secure string you create yourself. Keep a copy.
4. Click "Verify and Save".
5. On success, a green checkmark appears next to both "1. Configure webhooks" and "2. Generate access tokens".

G.3 — Subscribing to Fields

1. Under "1. Configure webhooks", enable at minimum: messages and messaging_postbacks.
2. Under "2. Generate access tokens", next to the connected Page, click "Add Subscriptions" and confirm the same fields are subscribed for that specific Page.

---

Part H — Connecting the Webhook to the Automation Logic

1. Extend the n8n workflow: after the Webhook (POST) trigger, parse the incoming JSON to extract the sender PSID and message text.
2. Route the extracted data into your automation/AI logic (AI response generator, database lookup, rules engine, etc.).
3. Use an HTTP Request node to send the reply back via the Send API:

POST https://graph.facebook.com/v21.0/me/messages?access_token={PAGE_ACCESS_TOKEN}
Body: { "recipient": {"id": "{sender_psid}"}, "message": {"text": "..."} }

4. Test by sending a real message to the Page from a personal account and confirm the automated reply is received.

---

Part I — Publishing the App (Going Live)

While the App is in Development Mode, only accounts with an Admin, Developer, or Tester role on the App can send/receive messages. Publishing is required so any real customer messaging the Page triggers the automation.

1. From the App Dashboard, click "Publish" in the left sidebar.
2. Fill in required fields: App Icon, Category, and the Privacy Policy URL (from Part F).
3. Review and confirm any remaining checklist items (e.g. Data Use Checkup, if applicable).
4. Click "Publish" to switch the App from Development to Live mode.

✅ Because permissions for this Page were already Standard Access ("Ready for testing"), publishing does not require a formal App Review submission for this use case — just the basic app info above.

---

Part J — Testing & Troubleshooting

J.1 — Final End-to-End Test

1. From an account that is not an Admin/Developer/Tester on the App, send a message to the client's Page.
2. Confirm the message appears in n8n's Executions log.
3. Confirm the automated reply is received back in Messenger.

J.2 — Common Issues

Symptom	Likely Cause	Fix
Webhook verification fails	n8n workflow not Active, or Test URL used instead of Production URL	Activate the workflow; use the Production URL
No data reaching n8n at all	Tunnel (ngrok) not running, or Page not subscribed to the App	Check ngrok status at 127.0.0.1:4040; re-subscribe the Page's webhook fields
Only your own messages trigger the bot	App still in Development Mode	Publish the App (Part I)
Token stopped working after ~60 days	A long-lived (non-permanent) token was used instead of a System User token	Regenerate via System User in Business Settings for a non-expiring token
Privacy Policy page shows blank	Publishing not fully propagated, or an ad-blocker is interfering	Wait a few minutes, test in incognito mode, try another device

---

📋 Credentials Checklist Template

Use this checklist for every new client onboarded onto the Messenger automation system.

Item	Value / Status	Notes
Client / Business Name
Business Portfolio ID
Facebook Page Name
Facebook Page ID
Meta App Name
Meta App ID
Page Access Token		Store securely; confirm "Never" expiry via Debugger
Webhook Callback URL
Webhook Verify Token
Privacy Policy URL
App Publish Status		Development / Live
n8n Workflow Name

---

👤 Author

Muhammad Antor

AI Automation Engineer | AutomateIQ Labs ⚡

Building official, compliant AI & automation systems for real businesses

---

⭐ If this guide helped you, please give it a star!

Built with ❤️ by AutomateIQ Labs · Bangladesh