How to Create a Facebook Access Token for Share Counts

A cut-paper key in graphite and grey with a blank paper tag tied to it by a grey string

Pick the token type first

Plugins that stopped working after a day or two were usually given a short-lived user token.

Token	Used for	Where it comes from
App access token	Server-side reads such as URL engagement	Your app ID and app secret
User access token	Acting as a person, testing in the Explorer	Login dialog or Graph API Explorer
Page access token	Posting to or reading a page you manage	Exchanged from a user token

Create an app access token

Create an app
Sign in to the Meta for Developers dashboard and create an app. See how to create a Facebook app ID for the choices on each screen.
Find the ID and secret
In the app's settings, under Basic, copy the App ID and reveal the App Secret.
Form the token
An app access token can be written as the app ID, a vertical bar, and the app secret: {app-id}|{app-secret}. Some plugins ask for the ID and secret separately and build it themselves.
Test it
Open the Graph API Explorer or the Access Token Debugger, paste the token, and confirm it is valid and shows no expiry.
Store it on the server
Paste it into your plugin settings or a constant in wp-config.php. Never put it in theme JavaScript.

Facebook access token worked example

The values here are invented and the shapes follow the cited access token guide. An app with ID 1234567890123456 and secret a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 gives the app token 1234567890123456|a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. To prove it works before touching the plugin, run one request against the debug endpoint, passing the token both as the thing to inspect and as the credential.

GET https://graph.facebook.com/{version}/debug_token?input_token={token}&access_token={token}

{
  "data": {
    "app_id": "1234567890123456",
    "type": "APPLICATION",
    "application": "Example Site Share Counts",
    "is_valid": true,
    "expires_at": 0
  }
}

Three fields matter. type should read APPLICATION for an app token; a USER type means you pasted an Explorer token that will expire within hours. is_valid must be true. expires_at of 0 means no expiry, which is what a background counter needs. Then make one engagement request for a post you know has been shared, as shown in fetching the Facebook share count, and confirm share_count is above zero.

In the same example, a long-lived user token generated on 1 April would show type: USER and an expires_at timestamp around 31 May. That token is fine for a tool that posts on your behalf and useless for a counter that must run unattended for years.

When you need a user or page token

Tools that post to your page automatically need a page token, which comes from a long-lived user token belonging to a page admin. That chain expires when the user changes their password or loses page access, which explains most sudden failures. The Access Token Debugger shows the expiry and granted permissions of any token.

Common errors

"Invalid OAuth access token": the token was copied with extra characters, has expired, or the secret was reset.
"Application request limit reached": the plugin is asking too often; cache counts and refresh less.
"Unsupported get request": the URL was not encoded, or the API version in the path is retired.

Error code	Message you see	What it means	Fix
190	Invalid OAuth access token	Token malformed, expired or revoked	Regenerate; paste without spaces or line breaks
4	Application request limit reached	App-level rate limit hit	Cache longer; refresh old posts less often
100	Unsupported get request	Bad URL encoding or a retired API version	rawurlencode the id; update the version in the path
102	Session has expired	User or page token past its expiry	Use an app token for counters; re-authorise for posting tools
10 or 200 to 299	Permission error	Token lacks a permission the call needs	Request the permission, or use a call that needs none

Codes and messages are those listed on the cited error handling page as of its capture date. The most common one on a share counter is 190, and the most common cause of 190 is a token pasted with a trailing space or a line break from a text editor.

What goes wrong

Pasting an Explorer token into a plugin. It works for an hour, then every count goes to zero. The debugger will show type USER and a near expiry.
Reusing one app across several sites. One rate limit is shared by all of them, and a secret reset for one site breaks the others. One app per site is cheaper than the confusion.
Storing the token in a theme file. A theme update or a public repository exposes it. Put it in wp-config.php or the plugin's settings table.
Leaving the app in development mode. Engagement reads still work, but widgets the same app powers show only to you; see the like button notes in the app ID guide.
Assuming the token is the problem. Counts stuck at an old value are more often a cron or cache fault; the order in share counts not updating rules those out first.

Check it worked

The debug_token response shows type APPLICATION, is_valid true and expires_at 0.
One engagement request for a known-shared URL returns share_count above zero.
The token appears nowhere in the rendered page source or in any file inside the theme folder.
The plugin's next scheduled refresh completes without an error entry in its log.
A note of the app ID, where the token is stored and who can reset the secret is filed somewhere the next site owner will find it.

For the wider picture, see the share counts section. Readers who get this far often also need tracking shares and pageviews in analytics or how share counts work, and why most networks stopped.

Sources

Questions

Which Facebook access token does a share count plugin need?

Usually an app access token, made from the app ID and secret. It does not expire unless the secret is reset.

Why did my Facebook token stop working?

User tokens expire after hours or about 60 days; page tokens stop when the admin's session is invalidated; app tokens stop when the secret is reset.

Is it safe to put the token in my theme?

No. Keep it on the server, in plugin settings or wp-config.php, never in public JavaScript.

How do I check whether a Facebook access token is valid?

Paste it into the Access Token Debugger, or call the debug_token endpoint with the token as both input_token and access_token. Look for is_valid true, the expected type, and an expiry that suits the job.

Does a Facebook app access token expire?

Not on its own. It stays valid until you reset the app secret or the app is removed or restricted, which is why it suits an unattended share counter better than a user token.

Hannah Voss, Editor. Checks every guide against a working WordPress install and the networks' current documentation. Last reviewed September 2026.

About the editor and our methods

Pick the token type first

Create an app access token

Create an app

Find the ID and secret

Form the token

Test it

Store it on the server