Facebook Ads API Approval: How to Get Your App Approved for the Meta Marketing API

Unmetered · September 20, 2026 · 12 min read

The Facebook Ads API, officially the Meta Marketing API, is how software reads and manages ad accounts programmatically: campaigns, ad sets, creative, spend, and performance data. Building against it is easy. Getting approved to use it in a real product is where most teams get stuck.

This guide walks the full approval path as it works today: the two access levels, business verification, the app review submission, and what to do when Meta rejects you. It reflects Meta's May 2026 changes to the Marketing API access tiers, so the steps match the current dashboard, not the process from three years of outdated tutorials.

What Facebook Marketing API approval actually means

There is no single "Marketing API approval." What you are really doing is moving specific permissions on your app from Standard Access to Advanced Access through Meta's App Review process. Understanding this distinction up front saves weeks.

Standard Access. Works for people who hold a role on your app (admin, developer, tester) and for assets your business owns. Enough for internal tools: pulling data from your own ad accounts, testing, building the integration.
Advanced Access. Works for any user or business that authorizes your app. Needed once you serve clients or customers: any tool where someone outside your team connects their ad account.

Standard Access is granted automatically when you create a Business-type app, so you can start building against your own ad accounts on day one with no review (Meta: Access Levels). Advanced Access must be approved permission by permission through App Review, and it requires Business Verification. Once you hold Advanced Access, Meta also requires an annual Data Use Checkup to keep it.

One useful quirk: if you ever downgrade a permission from Advanced back to Standard, restoring Advanced Access later does not require a new review.

Before you start: what to have ready

Gather these before touching the developer dashboard. Most rejected submissions trace back to something missing from this list.

A personal Facebook account in good standing (developer accounts hang off personal accounts)
A Meta Business portfolio (Business Manager) for your company, with you as admin
An active ad account with real spend history, connected to that portfolio
Legal business documents matching your business name exactly: formation docs, EIN letter, utility bill or bank statement showing the business address
A business website on your own domain, with a working privacy policy URL that names the data you collect and how users can request deletion
A business email on that same domain (a gmail.com address weakens verification)
A working build of your integration: reviewers must be able to see the API actually used in your product
A test user or demo account credentials you can hand reviewers
Screen recording software for the required screencast

Step 1: Create a Meta developer account and your Marketing API app

Goal of this step: an app in the dashboard with the right Marketing API use case attached.

01Go to developers.facebook.com, log in with your personal Facebook account, and click Get Started to register as a Meta developer (verify email and phone).
02Click Create App. Meta's flow is now built around use cases, not the old app types. Pick the Marketing API use case that matches what you are building (Meta: Marketing API use cases): "Create & manage ads with Marketing API" (build or edit campaigns), "Measure ad performance data with Marketing API" (reporting and analytics tools), or "Capture & manage ad leads with Marketing API" (lead gen integrations).
03Enter the app name (use your product's real name, no Meta trademarks like "FB" or "Insta") and a business contact email on your company domain.
04Connect your Business portfolio when prompted. It is listed as optional at creation, but connect it now: any app that touches data it does not own must be connected to a business portfolio, and verification runs through it.
05In the use case setup, click into the use case, review the permissions it bundles, and Add the ones you need. All three Marketing API use cases carry the same core set: ads_management, ads_read, business_management, pages_read_engagement, pages_show_list, public_profile, plus Ads Management Standard Access.

Request only permissions you can demonstrate in use. Every extra permission is an extra thing a reviewer can reject.

Step 2: Complete Meta Business Verification

Goal of this step: a green "Verified" status on the Business portfolio your app is connected to. Advanced Access is not granted without it, so start this early: it runs in parallel while you build (Meta: Business Verification).

01In the app dashboard, go to Settings, then Basic, then Verification, and click Start Verification. This routes you into the Security Center of the connected Business portfolio.
02Confirm your business details: legal name, address, phone, website. These must match your documents exactly. For example, "Acme Media LLC" on the form with "Acme Media Group LLC" on the documents is an automatic mismatch, and a dba only passes if it appears on the document itself.
03Upload documents. Meta accepts: certificate or articles of incorporation, business registration or license, government tax document (EIN letter), business bank statement, or a utility bill showing the legal business name and address (document guide).
04Verify your connection to the business, ideally by email at your business domain (matching the website you listed).
05Wait. Meta's stated window is up to 14 business days. In practice clean submissions often clear in hours to 7 days; mismatches push past 15.

Skip this step only if your app will never be used by anyone without a role on the app itself. For any client-facing tool, it is mandatory.

Step 3: Access tokens, test calls, and Standard Access

Goal of this step: a working integration with real API calls logged, because App Review requires proof of use before it will grant anything.

01Generate a token. For quick testing, use the Graph API Explorer with your app selected and grant yourself ads_read and ads_management. For production, create a system user in Business settings, assign it your ad account, and generate a long-lived system user token.
02Make real calls against your own ad account (campaign reads, insights pulls, whatever your product does). With Standard Access this already works for any account your business owns or any user with an app role.
03Log the calls App Review needs: at least one successful call with each permission you will request, within 30 days of submitting (Meta: submission guide).
04Know the second ladder: separate from permission access levels, the Marketing API has its own rate-limit tier, renamed in May 2026 from "Ads Management Standard Access" to Marketing API Access Tier (Limited and Full, formerly Standard and Advanced). New apps start in development access with tight call caps. To move up you now need 500+ Marketing API calls in the past 15 days with an error rate under 15%, requested from Permissions & Features in the dashboard; the screen recording for this tier request was dropped on May 4, 2026 (Meta blog).
05Practical sequencing: run your integration daily during the build phase. The same traffic that clears the 500-call tier threshold also generates the per-permission call evidence reviewers check.

Facebook API access token example

Once you have a token, your first Marketing API call is one line of curl. This pulls the campaigns from an ad account (replace the token and the account id, and check Meta's version changelog for the current API version; v25.0 shipped in February 2026):

curl -G \
  -d "fields=name,objective,status" \
  -d "access_token=YOUR_ACCESS_TOKEN" \
  "https://graph.facebook.com/v25.0/act_YOUR_AD_ACCOUNT_ID/campaigns"

For testing, generate a short-lived user token in the Graph API Explorer. For anything scheduled or server-side, use a system user token from Business settings: user tokens expire, system user tokens are built for machines.

How the Marketing API relates to the Graph API

The Marketing API is not a separate service. It is the ads-focused set of endpoints inside Meta's Graph API, which is why every call goes to graph.facebook.com and why the Meta Graph API Explorer works as a test console for ads calls. If you can read a Graph API doc, you can read the Marketing API documentation: same versioning, same token model, same error format.

Step 4: Submit Meta App Review for Advanced Access

Goal of this step: Advanced Access granted on each permission your product needs. Everything is submitted from App Review, then Permissions and Features in the app dashboard (Meta: submission guide).

Before submitting, confirm the app settings reviewers check first: a 1024x1024 app icon with no Meta trademarks, a live privacy policy URL, an accurate app category, app purpose (yourself/your business vs. clients), and a primary contact email.

01In Permissions and Features, click Request Advanced Access next to each permission. Typical reporting stack: ads_read plus business_management. Add ads_management only if your product creates or edits ads.
02Answer the data handling questions (how data is stored, shared, and deleted).
03Write a separate usage description per permission. Do not copy-paste between them. Each one must answer four things: how the permission benefits the end user, why the app cannot work without it, exactly what data is read or written, and what breaks if Meta does not grant it.
04Record the screencast (still mandatory for permission review, 1080p or better): show a real user logging in, granting the permission in the OAuth dialog, and then the feature that uses it actually working. English UI, no dead air, only the flow reviewers need to see.
05Provide reviewer access: step-by-step instructions plus working test credentials for a demo account where the integration is live.
06Submit and accept the Platform Onboarding Terms.

A usage description that passes looks like this (adapt, do not copy): "When an agency connects a client ad account, we call GET /act_id/insights daily with ads_read to populate the client's creative performance dashboard shown at 0:45 in the screencast. Without ads_read the dashboard cannot display spend or ROAS and the product has no function."

Meta's stated decision window is within a week; expect longer during high-volume periods, and budget for one rejection cycle.

Step 5: While your app review is pending

Meta's documentation says a decision "within a week," but 2026 practitioner reports put a normal cycle closer to 20 days, longer if reviewers ask for clarification, and every rejection restarts the clock (WoopSocial 2026 review guide). Treat the flagged number as observed, not official.

While waiting:

Keep the demo account live and the test credentials working. Reviewers log in on their own schedule; a dead login is an automatic rejection.
Keep API traffic flowing so your call logs stay fresh.
Watch the primary contact email and the dashboard notifications; clarification requests have short response windows.

If rejected: read the rejection note carefully (it names the failing permission), fix only what was denied, and resubmit only those permissions. Resubmitting already-approved scopes can push them back into review.

Step 6: After approval, staying approved

Approval is not permanent by default. Three ongoing obligations:

Data Use Checkup: an annual recertification of how each permission is used. Miss the window (Meta gives roughly 60 days of notices) and permissions get revoked (Meta: Access Levels).
Marketing API Access Tier: keep your call volume and error rate healthy. High error rates can hold you at the lower tier and its rate caps (Meta: rate limiting).
Platform Terms compliance: no reselling data, no using client ad data outside the disclosed purpose, honor deletion requests. Violations here are how approved apps lose access.

Also set a reminder to switch the app from development mode to live mode after approval; users outside your team cannot authorize an app still in development mode.

Common Facebook Ads API rejection reasons (and the fix)

Requested a permission the screencast never demonstrates. Drop the permission or add footage of the exact feature using it; this is the single most common failure.
Screencast skips login or the consent dialog. Re-record the full flow: login, OAuth grant screen, then the feature working.
One video covering several permissions. One recording per permission, each showing its own grant and use.
Demo uses a personal profile. Use a test user or a real demo business account reviewers can log into.
Generic usage description ("we manage ads for clients"). Name the endpoints, the data pulled, the screen it powers, and the timestamp in the video.
Business Verification incomplete at submission. Finish verification first; the review does not proceed without it.
Name or address mismatch in verification documents. Make the portfolio's legal name and address match the documents character for character.
Privacy policy missing, broken, or thin. Live URL on your domain covering collection, use, retention, and deletion requests.
Reviewer could not log in to the demo. Test credentials from a clean browser the day you submit, and keep them valid for a month.

Facebook Ads API approval FAQ

How long does Meta app review take? Meta's documentation says about a week. Developer reports in 2026 put a normal cycle closer to 20 days, and a rejection restarts the clock, so budget a month.

Do I need Business Verification to use the Marketing API? Not to start. Standard Access works immediately on ad accounts your business owns. Verification becomes mandatory the moment anyone without a role on your app needs to connect their account.

Is the Facebook Ads API free? Yes. There is no fee for API access at any tier; you pay only for the ads themselves.

What permissions does a reporting or analytics app need? ads_read plus business_management covers read-only reporting. Only request ads_management if your product creates or edits campaigns.

Is the Facebook Marketing API the same as the Meta Marketing API? Yes, one product. Meta renamed it with the company rebrand; older docs and forum threads say Facebook Marketing API, current official docs say Meta Marketing API.

Where is the official Facebook Ads API documentation? The Marketing API docs on Meta for Developers, plus the Graph API changelog for version deprecation dates.

Sources

Official Meta pages are the primary sources; the last three are practitioner reports used only for observed timelines and rejection patterns, labeled as such in the text.

Own the software you run.

Unmetered is a curated marketplace where vetted operators sell ready-to-run software, full source, one-time price, licensed to your organization forever.

Browse the catalog Sell what you built