How do I get a Meta Conversions API access token that never expires, and why did my server events stop with a token error?

TofuAnswer by the Tofu team · checked

A rusted old iron key resting against a corroded iron ring on a stone ledge

Use a system user token. Meta says these "do not expire based on time," though they can be revoked or invalidated, and some businesses must use 60-day expiring ones. Make one in Meta Business Suite settings, or with the "Generate access token" link on your pixel's Settings tab in Events Manager, which Meta recommends. Error 190 means the token expired or is no longer valid: often a personal user token (these last hours or about 60 days) or an expiring system user token that wasn't refreshed. Meta also rejects events if the token's user lost access to the pixel.

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

As of November 2026.

Should I create the token in Events Manager or as a system user?

Use Events Manager unless your developers already run their own Meta app. It's Meta's recommended route, and you don't need an app of your own. In Events Manager, choose your pixel, open the Settings tab and, in the Conversions API section, click Generate access token under Set up manually. Then, on the Overview tab, click Manage Integrations and Manage next to Conversions API. Meta says this "automatically creates a Conversions API app and Conversions API system user for you."

If you have your own app and system user, generate the token in Meta Business Suite instead: assign the pixel to the system user, select it and click Generate Token. For either route, Meta says there's no App Review and no permissions to request.

Why can't I see the Generate access token link?

You need developer access to the business. Meta says the link "is only visible to users with developer privileges for the business." In a business portfolio that's apps and integrations access (formerly the developer role), which Meta says lets people set up the Conversions API and create access tokens. Ask someone with full control of the portfolio to add it under Settings > People.

Do Conversions API access tokens expire?

It depends on the type of token:

Token typeHow long it lasts, per Meta's docs
Short-lived user token, such as one copied from Graph API ExplorerAbout 1 to 2 hours
Long-lived user tokenAbout 60 days
Non-expiring system user tokenNever expires based on time, but can still be invalidated
Expiring system user token60 days from when it was generated or refreshed, then lost if not refreshed

Meta also says "some businesses must use expiring tokens" without saying which, and that token lifetimes may change without warning or end early. Meta's CRM guide for platforms calls the token made in Events Manager a system user access token, but the Get started page doesn't say how long it lasts, so check yours in the Access Token Debugger.

Why did my server events stop with a token error?

Because Meta no longer accepts the token. Meta's errors come back as type OAuthException:

CodeWhat Meta says it means
190Access token has expired. Get a new one
190, subcode 463 or 467The token has expired, been revoked or is otherwise invalid
190, subcode 460The password changed
10, or 200 to 299A permission isn't granted or has been removed

The usual causes:

  • Someone's personal token. A user token dies after its lifetime, or sooner when the person changes their password or revokes permissions. If they left and were removed from your portfolio, their access to the pixel goes too.
  • An expiring system user token passed 60 days without a refresh.
  • The token was revoked. Meta says revocation is immediate.
  • The system user lost the pixel. Meta checks "whether the identified user has access to the requested resource" and rejects the request if not.

To check a token, paste it into Meta's Access Token Debugger at developers.facebook.com/tools/debug/accesstoken. Meta says it lets you "check for expiration, and validate the permissions granted."

How do I make a system user token?

Meta's help center gives these steps in Meta Business Suite:

  1. Go to Settings > Users > System users.
  2. Click Add new system user, name it and click Create system user.
  3. Assign assets. For the Conversions API, assign your pixel; Meta's Dataset Quality guide uses the Manage Pixel permission.
  4. Click Generate new token, select your app and permissions, then click Generate token.
  5. Copy the token and store it safely now. Meta says "you can only share a token once."

You must own a Facebook app linked to your portfolio, and Meta says "not all businesses have access to system users." Use a regular system user: Meta says "we do not recommend managing business' assets through an admin system user." Meta's overview allows 1 system user and 1 admin system user when your app has Standard access to the Ads Management Standard Access feature, and 10 system users (still 1 admin) with Advanced access.

The help article doesn't mention an expiry choice, but Meta's access token guide says you "choose a token expiration preference" when you generate one, and Meta's token API offers both a non-expiring token and a 60-day expiring one.

Which permissions should a CAPI access token have?

For your own pixel, Meta says you don't need to request any permissions. What matters is that the system user can use the pixel, so assign it. Platforms that send events for other advertisers are different: Meta says they need at least ads_read or ads_management. A missing permission shows up as error 10 or 200 to 299.

Is a token that never expires a security risk?

It can be, if it leaks. Meta calls expiring tokens "a security best practice" and says non-expiring ones suit cases where you "can tolerate the risk of leaked access tokens." Keep the token on your server or in your tag server's secrets, never in browser code or a shared doc. Replace it when someone who had it leaves.

How do I swap in a new token without losing events?

Deploy the new token before you revoke the old one. Generate it, put it in your server or integration and confirm events arrive; Meta says they should show in Events Manager "within 20 minutes." Then revoke the old token. Meta says that during rotation the old token keeps working until it expires, and that revocation "takes place immediately."

Can I resend the events we missed?

Yes, if they're no more than 7 days old. Meta says event_time "can be up to 7 days before you send an event," and if any event in a batch is older, it returns an error for the whole request and processes none. Send each event with an event_id: Meta keeps only the first copy of the same event_id and event name, which it says "makes batch retries safe." You can send up to 1,000 events per request. To make sure resent events don't double count with the pixel, see how to set up the Meta Conversions API without a developer. Once events flow again, see how to raise Event Match Quality on Meta lead events.

Sources (14)

Related answers

More on