META OAUTH
Maintained DivisionDesk documentation · Updated 2026-08-21
# Facebook & Instagram — DivisionDesk OAuth
Social Media 1.0.5 uses DivisionDesk Server Social OAuth Contract v1 for Facebook Pages and Instagram Professional accounts.
The client does **not** ask administrators for a Meta Page access token or the DivisionDesk Meta App Secret.
Connection flow:
1. Select Facebook and/or Instagram in the Core setup wizard.
2. Click **Connect Facebook**.
3. DivisionDesk requests a short-lived OAuth session from `/api/social/oauth/v1/start.php`.
4. The returned Meta/Facebook authorization URL opens in a new window.
5. The administrator approves the official DivisionDesk Meta app.
6. Meta returns to the permanent DivisionDesk Server callback `/api/social/oauth/v1/callback.php`.
7. The client polls `/api/social/oauth/v1/status.php`.
8. Authorized Pages and connected Instagram accounts are obtained from `/api/social/oauth/v1/assets.php`.
9. The administrator selects the desired Page/account.
10. `/api/social/oauth/v1/select-asset.php` returns an opaque DivisionDesk `connection_id` and one-time `connection_token`.
11. The connection token is stored in Core `SecretVault`; provider Page/user tokens remain on DivisionDesk Server.
Disconnect uses the frozen `/api/social/oauth/v1/disconnect.php` contract.
Meta App Secret and Meta access tokens must never be put in module settings, package files, logs, URLs, or browser-visible HTML.
## Core browser bridge
Beginning with Social Media 1.0.8, the setup wizard calls Core's package Smart Action endpoint directly. It does not depend on JavaScript from the Social Media admin dashboard. The browser request invokes `social-media:social-broker`; the PHP Smart Action then calls the frozen DivisionDesk Server Social OAuth Contract v1.
Social Media 1.0.5 uses DivisionDesk Server Social OAuth Contract v1 for Facebook Pages and Instagram Professional accounts.
The client does **not** ask administrators for a Meta Page access token or the DivisionDesk Meta App Secret.
Connection flow:
1. Select Facebook and/or Instagram in the Core setup wizard.
2. Click **Connect Facebook**.
3. DivisionDesk requests a short-lived OAuth session from `/api/social/oauth/v1/start.php`.
4. The returned Meta/Facebook authorization URL opens in a new window.
5. The administrator approves the official DivisionDesk Meta app.
6. Meta returns to the permanent DivisionDesk Server callback `/api/social/oauth/v1/callback.php`.
7. The client polls `/api/social/oauth/v1/status.php`.
8. Authorized Pages and connected Instagram accounts are obtained from `/api/social/oauth/v1/assets.php`.
9. The administrator selects the desired Page/account.
10. `/api/social/oauth/v1/select-asset.php` returns an opaque DivisionDesk `connection_id` and one-time `connection_token`.
11. The connection token is stored in Core `SecretVault`; provider Page/user tokens remain on DivisionDesk Server.
Disconnect uses the frozen `/api/social/oauth/v1/disconnect.php` contract.
Meta App Secret and Meta access tokens must never be put in module settings, package files, logs, URLs, or browser-visible HTML.
## Core browser bridge
Beginning with Social Media 1.0.8, the setup wizard calls Core's package Smart Action endpoint directly. It does not depend on JavaScript from the Social Media admin dashboard. The browser request invokes `social-media:social-broker`; the PHP Smart Action then calls the frozen DivisionDesk Server Social OAuth Contract v1.
Still need help? Search the Community for real-world discussion, or submit a Feature Request if the product itself needs to change.