This page shows how to make the token, which of Meta's two routes to pick, where to paste it and how to keep it private. If you already have a token and Meta has started to refuse it, read Meta Conversions API access token stopped working instead.
What the token is
The token is a long string your server sends with every request to Meta. It is not your Facebook password, and it does not open your Meta account. It does let whoever holds it send events to your pixel, so treat it like a password.
Meta also calls the pixel a dataset. Both words mean the same thing on these screens.
Route 1: Generate access token in Events Manager
This is the route Meta describes first, and the one most Shopify stores need.
- 1Open Meta Events Manager and choose the pixel your ads use. On Shopify this is usually the pixel the Facebook & Instagram app set up.
- 2Open the Settings tab.
- 3Find the Conversions API section. Under Set up manually, click Generate access token.
- 4Copy the token. Copy all of it: it is long, and a token copied in part is refused.
Meta may then show a window that asks you to select datasets, with every pixel of your business ticked. Untick every pixel except this store's. A pixel left ticked is linked for good, and Meta cannot undo it.
If you do not see Generate access token, it may sit behind Set up manually or Get started. Meta says the link "is only visible to users with developer privileges for the business." Ask the person who owns your Meta business to give you that access, or to make the token for you.
Route 2: a system user in Business settings
Meta's second route is for businesses that already run their own app and system user. A system user is an account inside your Meta business that belongs to no person. Meta's steps are:
- 1Go to your business Settings.
- 2Assign the pixel to your system user. You can create a new system user at this step.
- 3Select that system user and click Generate Token.
When you make a token this way, Meta asks how long it should last. Meta's system user guide calls tokens that expire the security best practice, and suggests a 60-day token. A 60-day token stops working after those 60 days, and your server's purchases then stop until someone saves a new one. For a key that a tracking tool uses every day, choose Never and keep the token private instead.
System user or Generate access token?
The two routes are closer than they look. Meta's page says that clicking Manage next to Conversions API in Events Manager "automatically creates a Conversions API app and Conversions API system user for you." So both routes end with a system user token. The difference is who sets it up:
- The Events Manager route sets up the app and the system user for you, for one pixel. This is the route for a store owner without a developer.
- System users in Business settings is for a business that already has its own app and system user, and wants to choose which pixels that user can reach.
A token made by a system user does not depend on a person staying in your business. That matters when an agency or a former employee set up your tracking.
Which permissions you need
Less than most guides suggest. Meta's getting started page says the app "does not need to go through App Review" and "You do not need to request any permissions." What you do need is access:
- To make the token in Events Manager, your own Facebook account needs developer access to the business that owns the pixel.
- For a system user token, the pixel must be assigned to that system user before you generate the token.
A token only works for the pixel it was made for. A token made in one pixel's settings sends nothing to another pixel. If your store has two pixels, make one token for each. See Two Meta pixels on one Shopify store.
Where to paste it
Paste the token into the app or server that sends your purchases, next to the pixel ID. Not into your theme, a custom pixel or a Tag Manager tag in the browser. Those run in the shopper's browser, where anyone can read the page code.
In Tikra the token is called Meta key:
- 1In Tikra, go to Platforms and click Connect on the Meta row. Choose Paste your pixel ID and key if the window offers two choices.
- 2Check the Meta pixel ID. Tikra fills it in when it finds the pixel on your store.
- 3Click Open Meta Events Manager, open the pixel's Settings and make the token as in route 1.
- 4Paste it into Meta key and click Connect Meta (Add the key by hand when the window also offers Connect with Meta login).
Tikra asks Meta to confirm the pixel and the key before it saves anything. If Meta refuses, nothing is saved and the card says why.
Keep it safe
- Keep it on a server. Meta's access token guide says: "Never hard-code app access tokens into client-side code or app binaries." The same reasoning holds for a Conversions API token.
- Do not send it in chat or e-mail. Paste it straight from Meta into the tool that needs it. If you must hand it to someone, make a new one after the work is done.
- Know where your tokens are. Meta offers an Access Token Tool that lists your access tokens with debugging information for each.
- Remove what you no longer use. Meta's system user guide says you cannot delete a system user, but you can revoke all of its access tokens. When you stop using an app, remove it from your business as well.
- One token per tool. Then you can shut one tool off without the other.
How the token fits with the other ways to connect is in the Meta Conversions API on Shopify.
FAQ
Can I use the same token for two pixels?
Make one in each pixel's settings. A token made for one pixel does not send to another.
The token works, but my tool cannot see Meta's purchase count. Why?
Sending and reading are different rights. The token from Generate access token can send events, but in Tikra's checks it cannot read the pixel's statistics. See below.
Where Tikra fits
Tikra sends each paid online order of your Shopify store from our server to Meta through the Conversions API, as a Purchase, and keeps a record for each order: what was sent, when, and Meta's answer. Tikra stores the key encrypted and never sees your Meta password. When Meta stops accepting a saved key, the Meta badge changes to Action needed, orders are put on hold, and Tikra sends the held orders from the last 7 days again once a working key is saved. Tikra applies your customers' consent choices to every order, and in Strict mode an order is sent only with the buyer's consent. A written guarantee in our Terms covers eligible orders: at least 97 % reach each platform, fixed within 12 hours or a month's fee credited (Terms of Service, section 8).
The free diagnosis sends none of your orders anywhere. It shows your paid orders of the last 7 full days, how many came from a Meta, Google or TikTok ad, and, after a full day and 10 paid online orders, how many your shoppers' browsers reported. With a key that can read your pixel's statistics, it also shows Meta's count. The key made under Conversions API in Events Manager cannot read them. It still sends your orders.