Create a Meta System User for Facebook Lead Ads

A System User is a special non-human account inside Meta Business Manager designed for server-to-server integrations like this CRM. Its access token lasts indefinitely (as long as you don't revoke it) — so unlike the standard OAuth flow you won't have to reconnect every 60 days.

Use this when:

• You already manage your Pages inside Meta Business Suite
• You want an ad-manager-independent token (survives staff turnover)
• You're seeing repeated 60-day token expiry warnings in Integrations

Prerequisites

• Business Manager admin access on the Meta business that owns your Pages
• A Meta App (you can create one at developers.facebook.com)
• Your Facebook Pages must be owned by that Business Manager

Step 1 — Create the System User

1. Open business.facebook.com and pick your Business.
2. Click the ⚙️ Settings icon (bottom-left).
3. Under Users, choose System users → Add.
4. Name it something recognisable like alphorix-crm-integration, set role to Admin, and confirm.

Step 2 — Assign your Pages to the System User

1. Still in Settings, open the newly-created System User.
2. Click Add assets → Pages.
3. Tick every Page whose Lead Ads you want in the CRM.
4. In the permissions panel on the right, toggle on:
   • Access Page
   • Create ads for the Page
   • Manage Page
5. Click Save changes.

Step 3 — Generate the access token

1. Back on the System User's page click Generate new token.
2. Pick your Meta App from the dropdown.
3. Expiration: Never.
4. Tick these permissions (minimum required):
   • pages_show_list
   • pages_read_engagement
   • pages_manage_metadata
   • leads_retrieval
   • ads_management (only needed if you also want campaign-level attribution)
5. Click Generate token and copy it immediately — Meta only shows it once.

Step 4 — Paste the token in Alphorix

1. In this CRM go to Integrations → Facebook Lead Ads card.
2. Open Or connect with an access token at the bottom.
3. Paste the token you copied and click Connect with token.
4. We validate it against Meta, list every Page it can access, subscribe each to the Lead Ads webhook, and start syncing.

Step 5 — Verify

The Facebook card should now show:

• A green Live badge on each Page (webhook subscribed)
• A Token expires: Never badge (System User tokens don't expire)

Fire a test submission from Meta Ads Manager → your new lead should appear in /leads within seconds.

Troubleshooting

"Token is valid but the account doesn't manage any Pages" → Your System User has no Pages assigned. Go back to Step 2.

"Facebook rejected the token" → The token was truncated when pasting, or it lacks required scopes. Regenerate with all 5 permissions ticked.

Webhook won't subscribe → Your Meta App must have the Webhooks product enabled and the page object subscribed with the leadgen field. Ask your operator or open developers.facebook.com/apps/<APP_ID>/webhooks.

Security tips

• Never share a System User token in Slack, email, or version control.
• Rotate the token if a Business Manager admin leaves (regenerate in Step 3).
• The CRM stores the token encrypted at rest (Fernet) — never as plaintext.