Business Management APIs

Best Practices

Follow these best practices if you're a Facebook Marketing Partner or an advertiser managing ad accounts or Pages. How you handle assets depends on your role and ownership, so here's a list of different approaches you can take.

2-Tier Business Manager Solution

The 2-tier Business Manager solution is a scalable solution for a Business Manager to create and manage child businesses. It allows you to:

  • Create and delete hundreds or thousands of small Business Managers (Child Business Managers) underneath a parent Business Manager.
  • Manage the spend of those Child Business Managers through a single line of credit.
  • Create a small business presence.
  • Create assets for the user.
  • Offer Facebook ads to your end user on your website or platform.

Managing Ads and Pages

Marketing Partner Owns Ad Accounts and Pages.

Marketing Partner Owns Ad Accounts. Customer Owns Pages.

Advertiser Owns Ad Accounts and Pages

No Ad Account

Marketing Partner Owns Pages.

Customer Owns Pages.

Customer Logs in Marketing Partner

The customer owns the assets and they login to the Marketing Partner app directly. The Marketing Partner app uses the user's token.

  • There is no code change required for apps that use the user's token to take action. The customer signs in and the app gets the token that gives the app access to the user's assets just as before.
  • As before, a long lived token can be requested for this user to take care of short-term unattended actions for the user.
  • A customer is more likely to have multiple ad accounts and pages connected to their real user. We recommend that your app allows the customer to choose the ad accounts and Pages they want to use on Marketing Partner platform.

Marketing Partner Employees Manage Assets

The Marketing Partner owns the assets and manages them using employees.

  • Add employees in the Marketing Partner's BM, and assign roles for each employee to the required assets. Much of our Agency documentation discusses this method.
  • Sometimes the Marketing Partner needs to have a very large pool of employees (like a Call center) operating on ad accounts or pages owned by the Marketing Partner.
  • Where possible we recommend each employee be added to the BM
  • If the number of employees becomes too large, the Marketing Partner can have its own employees authenticate directly and use a system user (scenario C) to automate actions. This requires that the Marketing Partner map these employees to the correct assets in their own systems. We limit the number of system users that each Business Manager can create as they are meant to support automation only and a 1 to 1 mapping is not supported. for 1:1 mappings, please add the users directly as employees into the BM. This style of ‘independent authentication’ is only permissible if all people using it are employees of the Marketing Partner. For anything that interacts with the end customer, they should be authenticating using the customer's Facebook credentials or by having the customer authorize the Marketing Partner's BM.

Marketing Partner Stores Customer's Passwords

The Marketing Partner manages customer ad accounts by saving or storing customer passwords.

  • This is not an approved model. Customers should not store end customer passwords.

Marketing Partner Helps Customers with Troubleshooting

The Customer owns their ad accounts and assets, but Marketing Partner employees need access for customer ad accounts for troubleshooting reasons.

  • Ask the customer to authorize the Marketing Partner’s Business Manager from their page or ad account with the right level of access.
  • Within the Marketing Partner’s Business Manager, any employee can now be granted up to the level of access the customer granted the Marketing Partner's Business.
  • If there is a support organization, one or more Business Managers can be setup to include the right staff and achieve the desired level of isolation between employees.
  • When the task is completed, the Marketing Partner can remove the ad account or page from the Marketing Partner’s Business Manager to reduce liability. Alternatively the customer can revoke access.

Marketing Partner Owns Ad Accounts and Customer Owns Pages

The Marketing Partner owns the ad accounts for customers, while customer owns its own Pages.

  • The customer does not have to create its own Business Manager, if it has only a few Pages.
  • Marketing Partner's Business Manager asks for the access to a customer Page. If the Marketing Partner user is an admin of the Page, that access would be granted immediately. Otherwise, a Page admin needs to grant it.
  • Once the Marketing Partner BM can access the Page, it can assign its own users to access the Page, thus can create ads for it.

How to Organize Ad Accounts and Pages

The Marketing Partner has multiple ad accounts and customer Pages, and wants to map which assets are for which customer.

  • Marketing Partner has all those ad accounts and Pages owned or accessed by the Marketing Partner BM, which can have multiple Projects created. There is one Project for each customer, whose ad accounts and Pages would be included in that Project. Marketing Partner users create ads in the context of a Project to avoid using a wrong ad account to create ads.

Don't Want to Use a Personal Login?

The Marketing Partner or customer employees don't want to use their personal Facebook login to access Business Manager.

  • We recommend that the Marketing Partner or customer employees log into Facebook using their personal login, and access ad accounts or Pages using their user access tokens. This approach increases work accountability.
  • If the Marketing Partner or customer creates a fake Facebook user and allows multiple employees to login using that user, Facebook might identify that user as a spam user and suspend it.

Use System User Without Ads

The Marketing Partner app does not have Ads Management access, but still wants to use the BM system user to invoke Page APIs.

  • System Users of Business Manager can be created with Ads Management apps. Those without Ads access, such as Page Marketing Partners, need help from Facebook to add the Marketing Partner to an allow list. Please work with your partner manager to do this.
  • Once such a system user is created, you can generate a page-only access token, which can be used to invoke Pages API.