Share counts
How to create a Facebook access token
Quick answer
For a WordPress plugin that reads share counts, the usual choice is an app access token, formed from your app ID and app secret, which does not expire unless you reset the secret. User tokens from the Graph API Explorer last about an hour or two, and long-lived user tokens about 60 days. Create an app first, then generate the token type your plugin asks for.
On this page
Pick the token type first
| Token | Used for | Where it comes from |
|---|---|---|
| App access token | Server-side reads such as URL engagement | Your app ID and app secret |
| User access token | Acting as a person, testing in the Explorer | Login dialog or Graph API Explorer |
| Page access token | Posting to or reading a page you manage | Exchanged from a user token |
Create an app access token
Create an app
Sign in to the Meta for Developers dashboard and create an app. See how to create a Facebook app ID for the choices on each screen.
Find the ID and secret
In the app's settings, under Basic, copy the App ID and reveal the App Secret.
Form the token
An app access token can be written as the app ID, a vertical bar, and the app secret:
{app-id}|{app-secret}. Some plugins ask for the ID and secret separately and build it themselves.Test it
Open the Graph API Explorer or the Access Token Debugger, paste the token, and confirm it is valid and shows no expiry.
Store it on the server
Paste it into your plugin settings or a constant in
wp-config.php. Never put it in theme JavaScript.
When you need a user or page token
Tools that post to your page automatically need a page token, which comes from a long-lived user token belonging to a page admin. That chain expires when the user changes their password or loses page access, which explains most sudden failures. The Access Token Debugger shows the expiry and granted permissions of any token.
Common errors
- "Invalid OAuth access token": the token was copied with extra characters, has expired, or the secret was reset.
- "Application request limit reached": the plugin is asking too often; cache counts and refresh less.
- "Unsupported get request": the URL was not encoded, or the API version in the path is retired.
Questions
Which Facebook access token does a share count plugin need?
Usually an app access token, made from the app ID and secret. It does not expire unless the secret is reset.
Why did my Facebook token stop working?
User tokens expire after hours or about 60 days; page tokens stop when the admin's session is invalidated; app tokens stop when the secret is reset.
Is it safe to put the token in my theme?
No. Keep it on the server, in plugin settings or wp-config.php, never in public JavaScript.
Hannah Voss, Editor. Checks every guide against a working WordPress install and the networks' current documentation. Last reviewed September 2026.
Related guides
- How to create a Facebook app IDCreate a Facebook app ID for share counts, the fb:app_id tag and sharing plugins: the dashboard steps, the settings that matter, and vanishing like buttons.3 min read
- Facebook share count: getting it from the Graph APIHow to get the Facebook share count for a URL from the Graph API, why the old REST API stopped working, rate limits, and how plugins should cache the result.3 min read
- Share count not updating or not accurate: a fix listShare counts stuck, stuck at zero or wrong? Work through tokens, caches, cron, URL variants and rate limits in order, and why you should never add fake shares.3 min read