Persistent Meta Ads Access

Use a Meta Business Manager system user token for campaign-management scripts. Do not use Graph API Explorer tokens for recurring work; those are temporary user tokens and will keep expiring.

Recommended Setup

1. Open Meta Business Settings for the business that owns ad account act_237498386928767.
2. Create or select a Business app that is installed on that business.
3. Go to Users > System Users.
4. Create a dedicated system user for automation, for example: George Sites Ads Automation.
5. Assign assets to that system user:
   • Ad account act_237498386928767: admin access if scripts create/update campaigns, or analyst access for read-only reporting.
   • Page 1021980367669603: access if scripts create ads using that Page identity.
   • Pixel/dataset 321894611536162: access if scripts read or manage events.
   • The Business app: admin access for token generation.
6. Generate a token for the system user from the Business app.
7. Select only the permissions needed:
   • ads_read for reporting and verification.
   • ads_management for creating, updating, pausing, or activating campaigns.
   • business_management only if scripts need to manage business assets or permissions.
8. Store the generated token in a secret, not in the repo:

export META_SYSTEM_USER_TOKEN="EAAB..."

For local compatibility, the scripts also accept META_ACCESS_TOKEN, META_TOKEN, and /tmp/gsuk_george_meta_token, but META_SYSTEM_USER_TOKEN is the preferred long-term name.

Token Separation

Keep these separate:

• META_SYSTEM_USER_TOKEN: Marketing API access for campaign and ad-account operations.
• FACEBOOK_CONVERSION_API_TOKEN: Pixel/Conversions API event sending from the website.
• FACEBOOK_PIXEL_ID: Pixel/dataset ID, currently 321894611536162.

The CAPI token can keep powering server-side conversion events. It is not the credential to use for Ads Manager automation.

Local Verification

From the repository root:

cd "/Users/georgelane/Dropbox/Projects/Georges-Sites-UK"
export META_SYSTEM_USER_TOKEN="EAAB..."
python3 ad-creative/facebook-june-2026/verify_paused.py
python3 ad-creative/facebook-june-2026/upload_embarrassment_replacements.py --check
python3 ad-creative/facebook-june-2026/upload_unseen_replacements.py --check

These checks should confirm access without activating anything.

Operational Notes

• Create a separate system user/token per client or business where possible.
• Prefer the least permission that works; use ads_read for checks and ads_management only for write scripts.
• Rotate the token if a laptop, logs, or shell history may have exposed it.
• If Meta returns permission errors despite a valid token, check asset assignment first. A token can have ads_management but still fail if the system user has not been assigned the ad account or Page.
• If using the local meta CLI, authenticate it with the same system-user token where supported, or keep using the environment variable for Python scripts.

Official References

• Meta system users: https://developers.facebook.com/docs/business-management-apis/system-users/
• Meta access tokens: https://developers.facebook.com/documentation/facebook-login/guides/access-tokens/
• Long-lived user token guide, for contrast with system users: https://developers.facebook.com/documentation/facebook-login/guides/access-tokens/get-long-lived/