Get Access

Getting access to ThreatExchange is done through Facebook Developer Applications, and has a few steps:

  1. Creating a Facebook account if you do not already have one.
  2. Find your company's business account, or creating a new account if your company doesn't have one.
  3. Creating a ThreatExchange application connected to your business account and adding the ThreatExchange product.
  4. If your business account is not already business verified, you'll need to verify it. This is the longest step and can take 2 or more weeks with multiple submissions.
  5. Making a ThreatExchange App Submission. This usually takes 1-2 business days to complete.

Creating the Application and Business Verification

To get access to Threat Exchange, you will need to have a business verified Application. We recommend creating a dedicated app to handle your ThreatExchange integration, with a name like "YourCompany ThreatExchange".

  • To create a new Business app, follow the instructions here. Make sure to select type "Business" during creation.
  • To get your business verified, follow the instructions here.

Terms of Use

Please see the Terms and Conditions—depending on your company, you may want to obtain sign-off from your company's legal team.

Add the ThreatExchange Product

If your application category is Business, you can find ThreatExchange on the Products section of your application dashboard. If you don't see it there, confirm that your app type is "Business" (circled red area in the banner at the top of your dashboard). If your app type is not Business, unfortunately you will have to create a new application, as it is currently not possible to change it after creation.

When you click on "Set Up" on ThreatExchange, it will add the ThreatExchange product in your sidebar, where you can continue the submission.

Start the Submission

Fill Out App Settings

ThreatExchange uses the Meta platofrm Application framework for access, but there is no expectation that there is an installable app or users outside of employees at your company. Unfortunately, you'll need to provide some inputs to make that framework happy, which can be set on the application basic settings page.

  • Enter URLs appropriate for your organization and any company logo for the "app icon".
  • For "platform", use "website" and your company's URL.
  • Business verification can take some amount of time to get through. Please contact us at with any issues.

Fill Out Your Use Case

Make the App Public

If you haven't already done so, check that you have changed the app's status to "Live".

Submit for Review

If you get a message about needing to upload an Android or iOS version of your app (ThreatExchange does not use installable apps), go back to Settings -> Basic. Ensure that for "platform", you have used "website" with your company's URL.

Once Review Is Complete

The name ThreatExchange appears with a green checkmark, and you see the subproducts "Descriptors", "Tags", and so on, in addition to "App Review", which you had seen up until now.

Do a power search for tag "testing"—you should see results.

Adding Users to an ThreatExchange Account

If your company already has a business account, here are the steps for adding users:

1) Users must do the following before being added to the account:

  • a) create their own Facebook account if they don't already have one.
  • b) register as a Facebook developer by following these steps.

2) There are two options to be added to a ThreatExchange app account. One uses "business accounts", and the other is for an admin to directly add a personal account to the application. Using the business account allows you to separate your work and personal usage more cleanly. Learn more about adding people to a business account here. From for your business, you can invite people to your business.

3) Using the person's work email, invite them to your business account. You don't need to give them any permissions at this point.

As of July 2023, this is what the "Add Person" flow looks like:

You'll be leaving all the defaults and not assigning any permissions at this stage.

4) After the person has accepted the invite, you can then assign them to the ThreatExchange Application:

You'll need to assign at least at the "Develop App" level, but "Manage App" can also simplify fixing settings.

Next, learn about Best Practices for Using ThreatExchange.