Why Meta rejects apps

What the reviewer sees

A wall of text, or one paragraph covering every permission. The reviewer can’t tell where to click, so they stop and reject.

The fix

• Write numbered steps for each permission separately: where to go, what to click, what should happen.
• Start every set of steps from the login screen, not from somewhere deep in the app.
• Name the permission at the step where it is used, and match the order of your screencast.

What the reviewer sees

Test credentials are missing, expired or only cover one layer. The website login works, but there is no Facebook, Instagram, Threads or WhatsApp account to connect, or two-step verification blocks the reviewer.

The fix

• Give credentials for every layer: your app’s login, plus a Facebook, Instagram, Threads or WhatsApp test account with the right role.
• Turn off two-step verification, IP allow-lists and invite-only signup for the test account.
• Unlock paid features and skip onboarding, so nothing stands between login and the feature.
• Log in from a private window on another network before submitting.

What the reviewer sees

The permission is real, but what the video shows belongs to a different one. The most common mix-up is between the two engagement permissions.

The fix

• Map each permission to one feature before recording.
• pages_read_engagement is for reading the Page’s own posts, followers and metadata, so show posts or Page stats loading in your app.
• pages_manage_engagement is for acting on comments as the Page, so show replying to, hiding or deleting a comment, then show the result on Facebook.
• pages_read_user_content covers what visitors post, such as comments, posts and reviews from other people.

What the reviewer sees

The privacy policy URL returns a 404, redirects to a login page, or is a generic template that never mentions Meta data.

The fix

• Use a public URL that loads without login, on your own domain.
• Name your app or company, list the Meta data you collect, why, how long you keep it, and how users can delete it.
• Add a working data deletion callback URL, or a page with deletion instructions.

What the reviewer sees

The App URL, Site URL or App Domains in Basic Settings are empty, point to a placeholder, or don’t match where the reviewer is told to log in. OAuth redirect URIs don’t match either, so login fails.

The fix

• Set the Site URL and App Domains to the live domain the reviewer will use.
• Add every redirect URI your login uses under Valid OAuth Redirect URIs.
• Make sure the URL in your notes, the URL in settings and the URL in the video are the same.

What the reviewer sees

In the video, Facebook Login (or the “Edit access” screen) lists fewer permissions than the submission. The reviewer can’t see the user granting what you asked for.

The fix

• Add every requested scope to your login call, or to your Facebook Login for Business configuration.
• Record the full permission dialog, and open “Edit access” so each scope is visible.
• Remove scopes from the submission that your login never asks for.

What the reviewer sees

App Review shows no successful API calls for the permission, or the scope isn’t in the login request at all. To Meta it looks unused.

The fix

• Make at least one successful call for each permission with a test user before submitting. App Review shows the call count next to each one.
• Request only what the feature needs. business_management is not needed to list Pages; pages_show_list does that.
• If a feature isn’t built yet, leave its permission out of this submission.

What the reviewer sees

The app shows “Posted!” or “Message sent”, but the reviewer never sees it arrive on Meta’s side, so there is no proof the permission did anything.

The fix

• For every permission, show the action in your app and then the result on Facebook, Instagram, Threads or a WhatsApp phone.
• Keep a second window or phone on screen for that moment.

What the reviewer sees

The same paragraph is pasted under every permission, or it says things like “to improve our service”. The reviewer can’t tell who uses the feature or why.

The fix

• Write one short paragraph per permission: who the user is, what they do, and what they get.
• Use the permission’s own language. For messaging: “Support agents reply to customer DMs from one inbox.”

What the reviewer sees

Messaging permissions or Human Agent are requested, but the video only shows automated replies.

The fix

• Show a person reading the message and typing the reply in your inbox.
• For Human Agent, show a conversation older than 24 hours and the human reply arriving in Messenger or Instagram.

What the reviewer sees

instagram_business_* scopes requested with Facebook Login, or instagram_basic with Instagram Business Login. The reviewer can’t exercise the permission in the flow you showed.

The fix

• Instagram Business Login uses the instagram_business_* scopes.
• Facebook Login needs a Facebook Page linked to the Instagram account, and uses instagram_basic, instagram_manage_messages and so on.

What the reviewer sees

A personal Instagram account instead of a professional one, “Allow access to messages” turned off, a Threads tester invite not accepted, or a new account with no data, so insights are blank.

The fix

• Use a Business or Creator Instagram account, with message access for connected tools turned on.
• Accept tester invites before recording.
• Use an account with real activity, or create the activity on camera.

What the reviewer sees

Advanced Access needs a verified business, and the legal name, address or phone on the documents doesn’t match Business Manager or the website.

The fix

• Use the exact legal name everywhere: documents, Business Manager and the website footer.
• Verify a domain or domain email first.
• For apps serving other businesses, complete Access Verification (Tech Provider) too.

What the reviewer sees

Buttons that do nothing, placeholder screens, or a loading spinner where the result should be. Reviewers test the app as it is.

The fix

• Submit only the permissions whose features work end to end today.
• Request the rest in a later submission, once they’re built.

What the reviewer sees

The interface or video is in a language other than English, with no captions, so the reviewer can’t follow what happens.

The fix

• Switch the app to English for the recording, or add English captions to every step.
• Write the notes in English, even if your users don’t use it.

What the reviewer sees

Names like “InstaHelper” or “FB Tools”, or an icon that looks like a Meta logo. These fail Meta’s brand rules.

The fix

• Use your own product name and icon.
• Mention Facebook or Instagram only to describe what you connect to, as in “Scheduler for Instagram”.