What to do
Open Meta Events Manager, select the correct dataset, open Settings, find the Conversions API section, and generate an access token. Copy it once, store it in a secure server-side environment variable, and confirm the dataset ID and token belong to the same client setup.
Generate the token from the correct dataset
Start in the client's Meta business and open Events Manager. Select the dataset used by the website and ad account, then open its Settings area.
The Conversions API section provides the option to generate an access token when your account has the required permissions. Copy the token when Meta shows it.
- Open the correct Meta business
- Select the correct dataset
- Open dataset Settings
- Find Conversions API
- Generate and copy the access token
Keep the access token out of public code
An access token is a secret. Anyone who can read public page JavaScript can copy a token placed there. Store it in server environment variables or a protected secret manager.
The website script should call your controlled endpoint. The endpoint should read the token privately and send the event to Meta.
- Do not paste it into page HTML
- Do not commit it to GitHub
- Do not expose it in browser responses
- Use environment variables
- Replace it if it was exposed
Common access-token problems
A token may fail because it belongs to the wrong dataset, the account lost access, the token was copied incorrectly, or the server is using an old secret.
When troubleshooting, check the API response and confirm the exact dataset ID used by the request. Do not solve token errors by moving the secret into the browser.
- Wrong dataset ID
- Wrong business or client account
- Insufficient permission
- Expired, replaced, or revoked token
- Environment variable not redeployed
Meta access-token check
01Select the correct client dataset
02Generate the access token in Events Manager
03Copy it immediately
04Store it as a server-side secret
05Confirm the server uses the matching dataset ID
06Redeploy after changing environment variables
07Replace the token if it was exposed
Common questions about this setup
How to get Meta CAPI access token?+
Open the dataset in Meta Events Manager, go to Settings, find the Conversions API section, and generate the access token.
Can I put the Meta CAPI access token in JavaScript?+
No. Public JavaScript can be viewed by website visitors. Keep the token in a protected server environment.
Is the access token connected to the Pixel ID or dataset ID?+
Use the dataset selected in Events Manager and ensure the server request sends events to that matching dataset ID.
What should I do if I exposed the token?+
Generate or rotate the token, update the protected server secret, redeploy the service, and remove the exposed value from code and history where possible.
Official references
Use these official references when checking the current Meta setup and account screens.