There is a special kind of optimism that comes from seeing a green "connected" badge next to an API credential. For a few minutes I genuinely believed the difficult part of the Meta integration was behind me.
Connected to my assets. Not the internet.
n8n could read the Facebook Pages I manage and the Instagram professional account connected to Virya. Then I tried to collect public data from external profiles. Every request failed.
OAuth opened one door
The first lesson was simple: access to my own assets proves access to my own assets. It does not prove that the application may inspect arbitrary Pages or use Instagram Business Discovery. OAuth, token validity, asset ownership, endpoint permissions and App Review are separate doors, even when the dashboard paints several of them the same shade of green.
Then I blamed the data
Before reaching that point I also blamed the data. A registry workflow scanned 3,991 CRM rows, created zero targets and reported more than three thousand invalid URLs. That looked impressive enough to be believable. The real problem was my parser swallowing an exception and returning an empty identifier.
I changed the audit output to show extracted URLs, valid and invalid counts, duplicates, reasons and a few examples. The next run produced 500 proper targets: 499 Facebook and one Instagram. Strange ratio, but correct for that sorted batch. The database was messy; the parser was messier.
Instagram added another staircase
Instagram added another layer. I initially used the user OAuth token directly. The proper chain was user token → managed Facebook Page → Page access token → linked Instagram account → Business Discovery. After fixing that, Meta returned error 10 for a known professional account. At that point another JavaScript tweak was not going to help. The blocker was application access and review.
A token is not a debug field
During testing I found a security mistake of my own too: the dynamic Page token travelled through ordinary workflow data, which meant it appeared in execution history. Convenient? Yes. A good production design? Absolutely not. Secrets now stay in credentials or an isolated server-side path. A token is not a debug field.
One broken collector should not stop the band
Most importantly, the blocked collector no longer blocks everything else. The CRM already contains websites, public emails, genres, notes and submission routes. Outreach can continue from that evidence, while social enrichment remains explicitly marked as unavailable.
The boring checklist wins
My current integration checklist starts with the boring layers: network, authentication, token type, asset ownership, permission, application access, business verification, reviewed feature and finally the data itself.
A successful OAuth flow opened the first door. Meta had thoughtfully placed several more behind it.