Eliminate unsafe password sharing and cumbersome PDF instructions. Leads Connect interfaces directly with Meta Graph API v21.0 to assign partner access in seconds.
The agency generates a secure, tokenized onboarding link. The client opens the link without needing to create an account or password.
The client logs in via official Meta OAuth Login dialog (`dialog/oauth`). Meta returns a short-lived user authorization token directly to our server.
Our server queries Graph API edges to discover the client's Ad Accounts, Pages, Instagram accounts, and Pixels. The client checks which assets to share.
Leads Connect calls Meta's `/agencies` API edge to programmatically assign the agency as an official partner to each selected asset.
| Scope | Category | Purpose & App Review Justification |
|---|---|---|
| business_management | Business | Required to identify client Business Portfolios and programmatically request agency partner access to manage assets without password sharing. |
| ads_management | Ads | Required to establish agency partner relationships on selected client Ad Accounts and assign campaign management permissions. |
| pages_show_list | Pages | Required to display available Facebook Pages to the user so they can select which page to delegate to the agency. |
| pages_read_engagement | Pages | Required to verify Page status, category, and health during asset verification checks. |
| pages_manage_ads | Pages | Required so the agency can run advertising campaigns linked to the client's Facebook Page. |
| public_profile | Identity | Required by Meta Login to confirm user identity during the OAuth flow. |
| Identity | Used for audit logging and sending client onboarding completion notifications. |
Compliance with Meta Platform Terms Section 4.a
Leads Connect operates dedicated, timing-safe cryptographic webhooks for Data Deletion and App Deauthorization. When a user removes our app in Facebook, Meta sends an HMAC-SHA256 signed request. Our server immediately verifies the cryptographic signature against the app secret, permanently purges vaulted tokens, and returns a verified deletion confirmation code.