Meta’s Graph API evolves frequently; apps need review for sensitive permissions. Start from the smallest permission set that still lets marketing schedule posts or pull inbox metrics.
- Separate dev/prod Meta apps; never reuse prod secrets in branch previews.
- Persist page access tokens encrypted; refresh before expiry with monitoring.
- Subscribe to webhooks for comments or DMs only if moderation workflows exist.
Store lightweight social post metadata in SQL; cache hot counts in Redis for dashboards.