ThreatExchange is hosted on Meta's Developer Platform and requires a verified Business Portfolio, and one final ThreatExchange-specific review.
This page will walk you through each step in detail, though Business Portfolio and the Developer Platform may change over time, and so the most up-to-date help can be found on help pages specific to those tools.
To get access to ThreatExchange you will need to complete the following steps:
See also: Create a Facebook Account, managed Meta accounts
If you don't have a managed Meta account, you will need a Facebook account in order to be added to a Business Portfolio. This account is only used to verify that you are a real person and use the developer platform. Your personal details are kept separate from the business details, and information from your personal account will not be displayed on ThreatExchange. If you have a personal Facebook account, you should use it rather than create a new one in order to prevent the new account from being flagged as inauthentic.
Log in with an existing Facebook account or create a new account by visiting Join Facebook.
See also: Register as a Meta Developer
In addition to registering all ThreatExchange users on Meta for Developers, your company will need a Meta Business Portfolio.
Before setting up a new account, check internally to see if your company has a previously established account. Your company may have an existing Business Portolio if:
If you think it is likely that your company has a business portfolio but aren’t aren’t able to find it, reach out to threatexchange@meta.com for help.
Found your company’s verified Business Portfolio? Skip to the “ThreatExchange Submission” section.If you find that your company has an existing business portfolio, have one of your company's admins add you by following the steps for the business portfolio under Adding Users to Your ThreatExchange Account.
If your company does not have an existing Business Portfolio (see section above), then you will need to create an account and complete Business Verification. Note: If you just created a new Facebook account, you may be promped to wait a few hours before you can create a business portfolio.
While logged into your Developer account, go to the https://business.facebook.com/ and click Create an account.
Fill in the name of your company, your name, and a business email where you can receive a verification email. Click Submit to finish creating your business portfolio.
Note: If your company already has a Meta Business Manager account, you’ll see the following alert based on the email domain.
If you see this message, go to Determine if you already have a business portfolio above.
ThreatExchange is built on Meta’s developer platform (see Meta Apps).
You can see whether your Business already has a ThreatExchange app by navigating to https://business.facebook.com/settings/apps and looking for any with “ThreatExchange” in the name. If your company already has one, have one of your company's admins add you by following the steps for the business portfolio under Adding Users to Your ThreatExchange Account..
Now, when you return to the App Dashboard you should see your newly created app listed to finish setting up your app profile.
We will now mark that this application will be used for ThreatExchange by adding the ThreatExchange "product" to the app. Return to the App Dashboard, select your app, and scroll down to Add products to your app. Click Set up on the ThreatExchange product. This will add the ThreatExchange product in your sidebar, where you can continue the submission.
NOTE: If you don’t see the ThreatExchange app here, your app type might not be “business” - check in the top line of the screen. If it shows a type other than “Business”, unfortunately, there is no way to change it once the app is created, and you should Create a New App as described above.
We won't do anything with with the ThreatExchange submission until we've completed business verification, which will be later.
Business Verification is a crucial step to ensure you are an authorized representative of your company and to confirm that your company is a legal business entity. Click here for more information about this requirement.
You can visit https://business.facebook.com/settings/security to check if your business is already verified. If you are already verified, you can skip this step entirely!
If you see that instead that your business is "Ineligible for Verication", it means that either:
If you see instead that you are not verified, but eligible to submit, then proceed onward!
Business Verification requires official documents to confirm your company’s name, address, and phone number. Ensure you have at least 1-2 documents per section before completing the next steps.
Acceptance Documents to Verify NameOr others as defined by country here.
Acceptance Documents to Verify Address and Phone NumberOr others as defined by country here.
Make sure all of the details within your documentation are consistent with each other as discrepancies increase the likelihood the registration will be rejected. For example, if using “Company, Inc” in one document and “Company, Corp” in another document, the registration is likely to be rejected.
Use documents listed here and, if necessary, review Meta’s troubleshooting guidelines.
If your business is verified, you can move onto the next step. If your business is rejected, click here to troubleshoot why your business verification is rejected.
After completing all steps, click Submit for review to get access to the tool. You’ll receive an email confirming your access within 1-2 weeks.
If your application category is Business, you can find ThreatExchange on the Products section of your application dashboard. If you don't see it there, confirm that your app type is "Business" (circled red area in the banner at the top of your dashboard). If your app type is not Business, unfortunately you will have to create a new application, as it is currently not possible to change it after creation.
When you click on "Set Up" on ThreatExchange, it will add the ThreatExchange product in your sidebar, where you can continue the submission.
If you haven't already done so, check that you have changed the app's status to "Live".
If you get a message about needing to upload an Android or iOS version of your app (ThreatExchange does not use installable apps), go back to Settings -> Basic. Ensure that for "platform", you have used "website" with your company's URL.
The name ThreatExchange appears with a green checkmark, and you see the subproducts "Descriptors", "Tags", and so on, in addition to "App Review", which you had seen up until now.
Do a power search for tag "testing"—you should see results.
If your company already has a business portfolio or ThreatExchange account, here are the steps for adding more users:
1) The people you want to add must:
2) Learn more about adding people to a business portfolio here. From business.facebook.com/settings/people/ for your business, you can invite people to your business.
3) Using the person's work email (not their personal email), invite them to your business portfolio. You don't need to give them any permissions at this point.
As of July 2023, this is what the "Add Person" flow looks like:
You'll be leaving all the defaults and not assigning any permissions at this stage.
4) After the person has accepted the invite, you can then assign them to your company's existing ThreatExchange Application:
You'll need to assign at least at the "Develop App" level, but "Manage App" can also simplify fixing settings.
Next, learn about Best Practices for Using ThreatExchange.