Meta - Facebook and Messenger

ToolsAPI includes an official Meta integration for Facebook Pages and Messenger. It uses Meta OAuth, Graph API, Page webhooks, Messenger Send API and Meta's data deletion callback flow.

Find the integration in ToolsAPI

Signed-in users can reach the Meta integration from Dashboard, Services and My Profile under Available Services.

The direct user page is:

/settings/integrations/meta

Users with Social Media Tools management permission also see the platform configuration there. The admin path is:

/admin/social-media-tools/meta

Register the app

Open Meta for Developers:

https://developers.facebook.com/apps/

Create an app for Messenger/Facebook Pages and connect it to the correct Meta Business Portfolio.

Store the App ID and App Secret in the ToolsAPI UI. The secret is encrypted through the existing OAuth provider infrastructure and is therefore not stored in .env.

Server configuration

All environment variables used by config/meta.php are documented in .env.example:

META_AUTHORIZE_URL=https://www.facebook.com/dialog/oauth
META_GRAPH_BASE_URL=https://graph.facebook.com
META_GRAPH_VERSION=
META_WEBHOOK_VERIFY_TOKEN=
META_VERIFY_SSL=true
META_TIMEOUT=15

META_GRAPH_VERSION must match the Graph API version selected/shown for the current Meta app. ToolsAPI deliberately has no hard-coded default because Graph API versions change over time.

Choose META_WEBHOOK_VERIFY_TOKEN yourself and enter the same value when registering the webhook in Meta.

URLs to register with Meta

The admin UI displays the full absolute URLs. Default paths are:

OAuth callback: /oauth/meta/callback
Webhook callback: /meta/webhook
Data deletion callback: /meta/data-deletion

Permissions

Keep the first Messenger review narrow:

pages_show_list
pages_manage_metadata
pages_messaging

When Page comment support is needed, the connection flow also requests:

pages_read_engagement
pages_manage_engagement

Facebook Groups API is not part of this integration. It does not automate normal groups or personal profiles.

Flow

An admin registers the Meta app and stores App ID/App Secret in ToolsAPI.
A user opens /settings/integrations/meta and connects Facebook Pages.
ToolsAPI fetches Pages and stores Page access tokens encrypted.
The user subscribes selected Pages to Messenger webhooks and optionally Page feed events.
Incoming webhook events are verified using X-Hub-Signature-256, stored idempotently and mapped to the correct Page.
When basic auto reply is enabled, ToolsAPI replies through Messenger Send API using the RESPONSE messaging type.
The data deletion callback verifies Meta's signed request, removes the local Meta connection and returns a confirmation code/status URL.

Disconnect or remove the integration

A normal user can choose Disconnect Meta. ToolsAPI first attempts to unsubscribe connected Pages from Meta webhooks and then removes that user's local Page connections, Facebook OAuth connection and stored webhook events for those Pages. Local cleanup continues even if the Meta request fails, for example when an old token is already invalid.

An administrator or user with social-media-tools.manage can also choose Remove Meta integration. This is a full local reset that attempts to unsubscribe every connected Page and then removes the platform Meta app configuration, Facebook OAuth connections, Page connections and stored Meta webhook events from ToolsAPI.

The basic auto reply is intentionally separate from a future AI response engine. The webhook and Send API layer can be reused when AI orchestration is connected.

Tornevall Networks