ThreatExchange

Get Access

To get access to ThreatExchange you will need to complete the following steps:

  1. Creating a Facebook account if you do not already have one.
  2. Find your company's business account, or creating a new account if your company doesn't have one.
  3. Creating a ThreatExchange application connected to your business account and adding the ThreatExchange product.
  4. If your business account is not already business verified, you'll need to verify it. This is the longest step and can take 2 or more weeks with multiple submissions.
  5. Making a ThreatExchange App Submission. This usually takes 1-2 business days to complete.

Facebook Account

Create a Facebook account if you don’t have one

You will need a Facebook account in order to be added to an existing Meta Business Suite. This account is only used to verify that you are a real person and to log in to ThreatExchange. Your personal details are kept separate from the business details, and information from your personal account will never be displayed on ThreatExchange. If you have a personal Facebook account, we recommend you use it rather than creating a new one in order to prevent from being flagged as inauthentic.

Log in with an existing Facebook account or create a new account by visiting Join Facebook.

Register your Facebook account on Meta for Developers

  1. While logged into Facebook, visit [Meta for Developers](/developers.facebook.com/async/registration).
  2. Click Continue.
  3. Enter a contact email and click Send Verification Email. You’ll then receive a verification code needed to confirm your account.
  4. Select the role that most closely matches your experience and click Complete Registration.
See also:

Register as a Meta Developer

Creating the Application and Business Verification

To get access to Threat Exchange, you will need to have a business verified Application. We recommend creating a dedicated app to handle your ThreatExchange integration, with a name like "YourCompany ThreatExchange".

  • To create a new Business app, follow the instructions here. Make sure to select type "Business" during creation.
  • To get your business verified, follow the instructions here.

Terms of Use

Please see the Terms and Conditions—depending on your company, you may want to obtain sign-off from your company's legal team.

Add the ThreatExchange Product

If your application category is Business, you can find ThreatExchange on the Products section of your application dashboard. If you don't see it there, confirm that your app type is "Business" (circled red area in the banner at the top of your dashboard). If your app type is not Business, unfortunately you will have to create a new application, as it is currently not possible to change it after creation.

When you click on "Set Up" on ThreatExchange, it will add the ThreatExchange product in your sidebar, where you can continue the submission.

Start the Submission

Fill Out App Settings


ThreatExchange uses the Meta platofrm Application framework for access, but there is no expectation that there is an installable app or users outside of employees at your company. Unfortunately, you'll need to provide some inputs to make that framework happy, which can be set on the application basic settings page.

  • Enter URLs appropriate for your organization and any company logo for the "app icon".
  • For "platform", use "website" and your company's URL.
  • Business verification can take some amount of time to get through. Please contact us at threatexchange@meta.com with any issues.










Fill Out Your Use Case


Make the App Public

If you haven't already done so, check that you have changed the app's status to "Live".


Submit for Review

If you get a message about needing to upload an Android or iOS version of your app (ThreatExchange does not use installable apps), go back to Settings -> Basic. Ensure that for "platform", you have used "website" with your company's URL.





Once Review Is Complete

The name ThreatExchange appears with a green checkmark, and you see the subproducts "Descriptors", "Tags", and so on, in addition to "App Review", which you had seen up until now.


Do a power search for tag "testing"—you should see results.

Adding Users to an ThreatExchange Account

If your company already has a business account, here are the steps for adding users:

1) Users must do the following before being added to the account:

  • a) create their own Facebook account if they don't already have one.
  • b) register as a Facebook developer by following these steps.

2) There are two options to be added to a ThreatExchange app account. One uses "business accounts", and the other is for an admin to directly add a personal account to the application. Using the business account allows you to separate your work and personal usage more cleanly. Learn more about adding people to a business account here. From business.facebook.com/settings/people/ for your business, you can invite people to your business.

3) Using the person's work email, invite them to your business account. You don't need to give them any permissions at this point.

As of July 2023, this is what the "Add Person" flow looks like:

You'll be leaving all the defaults and not assigning any permissions at this stage.

4) After the person has accepted the invite, you can then assign them to the ThreatExchange Application:

You'll need to assign at least at the "Develop App" level, but "Manage App" can also simplify fixing settings.



Next, learn about Best Practices for Using ThreatExchange.