The Facebook Graph API, also called the Meta Graph API, is the main way apps get data into and out of Facebook. It's an HTTP-based API that lets an app query data, publish posts, manage ads and upload photos, and every request needs an access token and, ideally, a version number such as v26.0, the latest version Meta lists.
If you're a marketer rather than a developer, you'll mostly meet the Graph API through the tools you connect to Facebook. If you're building something yourself, here's the structure, the free testing tool and the limits worth knowing before you write a line of code.
How the Graph API is structured
Meta named it after the social graph, its picture of the information on Facebook. That graph is made of three things:
| Part | Meaning | Example |
|---|---|---|
| Node | A single object | A User, a Page or a photo |
| Edge | A collection of objects connected to a node | The photos on a Page |
| Field | Data about an object | A Page's name |
Meta's docs call nodes and edges endpoints. Because the API runs over HTTPS, it works with any language that has an HTTP library, and some requests even work straight in a browser. Every request goes to graph.facebook.com.
Access tokens: the key to every request
An access token proves who's asking and what they're allowed to see. Meta's docs describe two lifetimes:
| Token type | Typical lifetime |
|---|---|
| Short-lived | About one to two hours |
| Long-lived | About 60 days |
| Marketing API with Standard access | Long-lived tokens that don't expire based on time, though they can still be invalidated |
Tokens from web login are short-lived, and you can swap them for long-lived ones with a server-side call that uses your app secret. Apps built with Meta's iOS and Android SDKs get long-lived tokens by default. Meta also warns not to depend on these lifetimes, because they can change without warning or expire early, so your code should handle an expired token.
Using the Graph API Explorer
The Graph API Explorer is Meta's tool for testing queries before you build them into an app. Here's how to run your first one:
- Open the Graph API Explorer from Meta for Developers and choose your app from the Meta App dropdown. It lists apps where you're an admin, developer or tester.
- Get a User access token. It shows in the upper right of the tool.
- Run the default query, which asks for the id and name fields on the /me node.
- Check the response window. You'll see your app-scoped User ID and name.
- Add fields from the field viewer on the left, then click Get Code for sample code to start from.
Two buttons save time when something breaks. Copy Debug Information copies your query and response for a support request, and Save Session saves your query with the access token removed so you can share it safely.
One catch with permissions: while your app is in development you can grant it any permission for people with a role on the app. Once it's live, a permission that hasn't been approved through App Review makes your query fail.
Versions and why you should always set one
Each Graph API version is guaranteed to work for at least two years. A version stops being usable two years after the next version is released, and calls to an expired version fall back to the next oldest usable one.
If you leave the version out of a call, Meta treats it as unversioned and uses whatever version is set in your app dashboard under Settings, then Advanced. Meta recommends always specifying the version. The Marketing API has its own version numbers and schedule, separate from the Graph API.
Rate limits in plain English
Calls made with an app access token count against your app's limit, worked out over a rolling one-hour window as 200 calls multiplied by your number of users. It's an app-wide pool, not a per-person cap, so one busy user can make more than 200 calls as long as the app total stays under the maximum. Calls with a user access token count against that user's own allowance instead.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Busy endpoints return an X-App-Usage header showing how close you are to the limit, covering call count, total time and total CPU time. Check it and slow down before you hit the ceiling. The ads APIs have their own, different formulas based on active ads.
For ad accounts, campaigns and reporting, our guide to the Marketing API explains the separate access tiers and versions.
Where marketers meet the Graph API
- Scheduling tools and CRMs that post to your Page or pull your leads.
- Reporting dashboards that read your Page and ads data.
- Chat and messaging tools. For WhatsApp, see how the WhatsApp Business Cloud API handles automation.
If APIs are new to you, this plain-English guide to APIs in business messaging is a gentler place to start.
My verdict
The Graph API is well documented and the Explorer makes it easy to test before you commit. The three things to build around are all in Meta's own docs: tokens that expire, versions that retire after two years and app permissions that never went through App Review. Build for all three from day one and your connection will keep working long after launch.
You need an app before you can call anything, and our guide to registering a developer account walks through the steps on Meta for Developers.
Frequently asked questions
What is the Facebook Graph API?
It's the primary way to get data into and out of the Facebook platform, an HTTP-based API apps use to query data, post stories, manage ads and upload photos.
What is the latest Graph API version?
Meta's versioning page lists v26.0 as the latest Graph API version, and each version works for at least two years.
How long does a Facebook access token last?
Meta says short-lived tokens typically last about one to two hours and long-lived tokens about 60 days, but warns not to depend on those lifetimes.
What is the Graph API Explorer?
It's Meta's tool for testing Graph API queries with your app's access token, viewing the response and generating sample code.
What is the Graph API rate limit?
For app access tokens, Meta calculates calls within one hour as 200 multiplied by the number of users, across the whole app rather than per user.
