It's fairly common practice to request new permissions as your app grows and you add new features.

You need to be able facilitate Facebook logging in to your live app and approve the use-case for your API access request. You'll also need a way to manage a way to get your users to re-add their auth token, as new permissions will only be applied to new auth tokens.

Past this point I can't offer any advice as actually getting API access approved has always been a struggle for me and takes many attempts.