Get Access

ThreatExchange is hosted on Meta's Developer Platform and requires a verified Business Portfolio, and one final ThreatExchange-specific review.

This page will walk you through each step in detail, though Business Portfolio and the Developer Platform may change over time, and so the most up-to-date help can be found on help pages specific to those tools.

Overview

To get access to ThreatExchange you will need to complete the following steps:

1. If your company doesn't use managed Meta Accounts, you'll need a Facebook account if you do not already have one.
2. Find your company's existing Business Portfolio, or create a new portfolio if your company doesn't have one.
3. Create a ThreatExchange Application connected to your business and adding the ThreatExchange "product".
4. Go through business verification if your portfolio is not already verified.
5. Add detail to your ThreatExchange Application and submit your usecase for review.

Facebook Account

Create a Facebook account if you don’t have one

See also: Create a Facebook Account, managed Meta accounts

If you don't have a managed Meta account, you will need a Facebook account in order to be added to a Business Portfolio. This account is only used to verify that you are a real person and use the developer platform. Your personal details are kept separate from the business details, and information from your personal account will not be displayed on ThreatExchange. If you have a personal Facebook account, you should use it rather than create a new one in order to prevent the new account from being flagged as inauthentic.

Log in with an existing Facebook account or create a new account by visiting Join Facebook.

Register your Facebook account on Meta for Developers

See also: Register as a Meta Developer

1. While logged into Facebook, visit Meta for Developers.
2. Click Continue.

3. Enter a contact email and click Send Verification Email. You’ll then receive a verification code needed to confirm your account.
4. Select the role that most closely matches your experience and click Complete Registration.

Meta Business Portfolio

In addition to registering all ThreatExchange users on Meta for Developers, your company will need a Meta Business Portfolio.

Determine if your company has a Business Portfolio

Before setting up a new account, check internally to see if your company has a previously established account. Your company may have an existing Business Portolio if:

1. Your company is part of another exchange program that uses ThreatExchange.
2. Your company advertises on Meta properties (e.g. Facebook, Instagram, etc.). Ask internally about who manages this account (often marketing departments) to gain access and add users to ThreatExchange.

If you think it is likely that your company has a business portfolio but aren’t aren’t able to find it, reach out to threatexchange@meta.com for help.

Getting added to your company’s existing business portfolio

If you find that your company has an existing business portfolio, have one of your company's admins add you by following the steps for the business portfolio under Adding Users to Your ThreatExchange Account.

Create a New Business Portfolio

If your company does not have an existing Business Portfolio (see section above), then you will need to create an account and complete Business Verification. Note: If you just created a new Facebook account, you may be promped to wait a few hours before you can create a business portfolio.

While logged into your Developer account, go to the https://business.facebook.com/ and click Create an account.

Fill in the name of your company, your name, and a business email where you can receive a verification email. Click Submit to finish creating your business portfolio.

Note: If your company already has a Meta Business Manager account, you’ll see the following alert based on the email domain.

If you see this message, go to Determine if you already have a business portfolio above.

ThreatExchange App

ThreatExchange is built on Meta’s developer platform (see Meta Apps).

Determine if you already have a ThreatExchange App

You can see whether your Business already has a ThreatExchange app by navigating to https://business.facebook.com/settings/apps and looking for any with “ThreatExchange” in the name. If your company already has one, have one of your company's admins add you by following the steps for the business portfolio under Adding Users to Your ThreatExchange Account..

Creating a New App

1. While logged into your developer account, navigate to the App Dashboard and click Create App.
   
2. Choose “Other” as an answer for what you want your app to do and click next.
   
3. Select “Business” as the app type (ThreatExchange only works with Business even if other categories apply) and click next.
   
4. Add an app name such as “Company ThreatExchange” and confirm an email address with your company's domain is listed as the contact email for this app. Make sure also to link your company's business portfolio. Click Create App.

Now, when you return to the App Dashboard you should see your newly created app listed to finish setting up your app profile.

Add ThreatExchange

We will now mark that this application will be used for ThreatExchange by adding the ThreatExchange "product" to the app. Return to the App Dashboard, select your app, and scroll down to Add products to your app. Click Set up on the ThreatExchange product. This will add the ThreatExchange product in your sidebar, where you can continue the submission.

NOTE: If you don’t see the ThreatExchange app here, your app type might not be “business” - check in the top line of the screen. If it shows a type other than “Business”, unfortunately, there is no way to change it once the app is created, and you should Create a New App as described above.

We won't do anything with with the ThreatExchange submission until we've completed business verification, which will be later.

Business Verification

Business Verification is a crucial step to ensure you are an authorized representative of your company and to confirm that your company is a legal business entity. Click here for more information about this requirement.

Determine if You Are Already Verified

You can visit https://business.facebook.com/settings/security to check if your business is already verified. If you are already verified, you can skip this step entirely!

If you see that instead that your business is "Ineligible for Verication", it means that either:

1. You haven't yet linked your ThreatExchange app from the last step to your business portfolio.
2. Your ThreatExchange app was created with a type other than "Business". You can check the type from the settings screen, and create a new app with type business if you accidentally selected the wrong one.

If you see instead that you are not verified, but eligible to submit, then proceed onward!

Submitting for Verification

Document Preparation

Business Verification requires official documents to confirm your company’s name, address, and phone number. Ensure you have at least 1-2 documents per section before completing the next steps.

• EIN Documentation
• Certificate of incorporation or formation
• Business License

Or others as defined by country here.

• Utility bill
• Bank statement
• Business License

Or others as defined by country here.

Troubleshooting Business Verification

Make sure all of the details within your documentation are consistent with each other as discrepancies increase the likelihood the registration will be rejected. For example, if using “Company, Inc” in one document and “Company, Corp” in another document, the registration is likely to be rejected.

Use documents listed here and, if necessary, review Meta’s troubleshooting guidelines.

Complete Business Verification

1. While logged in, click your icon to open your app.
2. On the left sidebar, expand "App settings" and click Basic.
3. Scroll to the middle of the page and click Start Verification.
4. Confirm your Business Manager account and click Start Verification, which will take you to the Business Settings Security Center to continue with verification.
5. Click Start Verification, and then click through to get started.
6. Select the country that your organization is based.
7. Add your organization details and click Next. We recommend adding a Tax ID (EIN) if possible. Note: Make sure the details you submit exactly match the details of your legal business entity. Also make sure your business’s website loads and is HTTPS compliant.
8. If no matching record is found, upload supporting documents, such as a business license or articles of incorporation, to confirm the details you entered. Choose a method for confirmation.
9. After inputting all information, your verification status will be updated to In Review. You’ll typically hear back via email, but you can also check your status from the same page you submitted at.

If your business is verified, you can move onto the next step. If your business is rejected, click here to troubleshoot why your business verification is rejected.

ThreatExchange Submission

1. From the app dashboard with your ThreatExchange app selected, on the left sidebar, expand ThreatExchange and click App review.
1. If "ThreatExchange" is missing, you may have skipped adding the ThreatExchange product, above.
2. On the app review page, click Add to submission
3. This will add a new text box where you detail why you want access to the ThreatExchange product.

After completing all steps, click Submit for review to get access to the tool. You’ll receive an email confirming your access within 1-2 weeks.

Add the ThreatExchange Product

If your application category is Business, you can find ThreatExchange on the Products section of your application dashboard. If you don't see it there, confirm that your app type is "Business" (circled red area in the banner at the top of your dashboard). If your app type is not Business, unfortunately you will have to create a new application, as it is currently not possible to change it after creation.

When you click on "Set Up" on ThreatExchange, it will add the ThreatExchange product in your sidebar, where you can continue the submission.

Start the Submission

Fill Out App Settings

Basic Information

1. While logged into your Facebook account, go to your list of applications.
2. On the left sidebar, expand the App Settings and click Basic.
   
3. Fill in the required information.
   • Upload a 1024x1024 app icon (a screenshot of your company logo will do)
   • Paste a link to your company’s privacy policy URL
   • Choose a category for your company (see category descriptions here)
   
4. Click Save changes at the bottom of the page.
   

Add a Platform

1. At the bottom of the page, click Add platform.
   
2. Select “Website” and fill in the appropriate information.
   
3. Click to Save changes.
   

Fill Out Your Use Case

Make the App Public

If you haven't already done so, check that you have changed the app's status to "Live".

Submit for Review

Once Review Is Complete

The name ThreatExchange appears with a green checkmark, and you see the subproducts "Descriptors", "Tags", and so on, in addition to "App Review", which you had seen up until now.

Do a power search for tag "testing"—you should see results.

Adding Users to Your ThreatExchange Account

If your company already has a business portfolio or ThreatExchange account, here are the steps for adding more users:

1) The people you want to add must:

• a) Have an existing Facebook account, or create one if they do not (they should not create a second account if they already have a personal account!).
• b) register as a Facebook developer by following these steps.

2) Learn more about adding people to a business portfolio here. From business.facebook.com/settings/people/ for your business, you can invite people to your business.

3) Using the person's work email (not their personal email), invite them to your business portfolio. You don't need to give them any permissions at this point.

As of July 2023, this is what the "Add Person" flow looks like:

You'll be leaving all the defaults and not assigning any permissions at this stage.

4) After the person has accepted the invite, you can then assign them to your company's existing ThreatExchange Application:

You'll need to assign at least at the "Develop App" level, but "Manage App" can also simplify fixing settings.

Next, learn about Best Practices for Using ThreatExchange.