Key takeaways
- pages_manage_posts (creating/editing/deleting Page posts) requires pages_read_engagement, which itself requires pages_show_list — request and get approval for the full chain, not just the permission you actually call.
- Meta currently exposes two parallel Instagram publishing permission chains: the older instagram_content_publish (nested three deep under Facebook Login) and the newer, simpler instagram_business_content_publish (a single dependency, under Instagram API with Business Login) — mixing the two login flows is a plausible source of scope confusion.
- The commonly-discussed "Invalid Scopes" ordering trap is NOT something Meta's own permissions documentation describes as an ordering issue — what Meta does document is a dependency REQUIREMENT (missing a prerequisite permission), and community reports attribute the error to a deprecated, unapproved, or missing scope string, not to request sequence.
- A real end user simply has an ungranted permission silently dropped from their consent; the explicit "Invalid Scopes" message is shown to developers, in the OAuth debug response.
The permission dependency chain
pages_show_list has no dependency and returns the list of Pages a person manages. pages_read_engagement depends on pages_show_list and lets the app read Page posts, followers, and metadata. pages_manage_posts — the permission that actually creates, edits, and deletes Page posts — depends on both pages_read_engagement and pages_show_list. A review submission for pages_manage_posts that does not also carry approval for its two prerequisites will not function even if pages_manage_posts itself is approved.
Two different Instagram publishing chains
Meta currently documents two separate routes to Instagram organic publishing with different dependency graphs. The older route, under Facebook Login, chains instagram_content_publish → instagram_basic → pages_read_engagement → pages_show_list — a three-deep dependency. The newer route, under "Instagram API with Business Login," is instagram_business_content_publish → instagram_business_basic — a single dependency, and structurally simpler.
Nothing in Meta's documentation warns against mixing the two, but the dependency graphs do not interoperate — an app built against one login flow that starts requesting permissions from the other is a plausible, self-inflicted source of confusing scope errors. Pick one flow and stay inside its dependency chain.
Meta OAuth Invalid Scopes during App Review: what is and is not confirmed
Developer forum threads widely report an "Invalid Scopes" error appearing during Facebook Login and attribute it to requesting permissions "out of order." Checking Meta's own Permissions with Facebook Login guide directly finds no mention of an ordering requirement or an "Invalid Scopes" error at all — what it documents is DEPENDENCY, not sequence: a permission whose prerequisite was never requested or approved. Community reports on Meta's own developer forum describe the error appearing when a scope string is deprecated, unapproved for the app, or simply not present in the app's granted permission set — which lines up with a missing prerequisite, not with the order permissions were listed in a request.
One practical detail worth knowing: this specific error message is shown to developers, in the OAuth debug response — a real end user going through Login simply has an ungranted permission silently dropped from what they consent to, with no visible error at all.
FAQ
- Does pages_manage_posts need any other permission approved alongside it?
- Yes — it depends on both pages_read_engagement and pages_show_list, and a review submission needs all three approved together for Page posting to actually work.
- Should I use instagram_content_publish or instagram_business_content_publish?
- They are two separate dependency chains for Instagram publishing — the older one under Facebook Login (instagram_content_publish, three-deep dependency) and a newer, simpler one under Instagram API with Business Login (instagram_business_content_publish, single dependency). Pick one login flow and stay inside its chain rather than mixing the two.
- Does Meta officially document an "Invalid Scopes" error caused by requesting permissions in the wrong order?
- No — this could not be found documented by Meta as an ordering issue. What Meta's permissions documentation describes is a dependency requirement (a missing prerequisite permission); community reports attribute the actual error message to a deprecated, unapproved, or missing scope string.
- Who sees the "Invalid Scopes" error message?
- Developers, in the OAuth debug response — a real end user going through Facebook Login does not see this message; an ungranted permission is simply dropped from their consent silently.
- What is the base permission every Page-publishing chain depends on?
- pages_show_list, which has no dependency of its own and returns the list of Pages a person manages — every other Page permission in this chain builds on it.
- How current is this permissions list?
- Sourced directly from Meta's own Permissions Reference, which shows a last-updated date of 2026-09-14 as of this guide's 2026-09-23 check — re-verify against Meta's live reference before relying on exact permission names, since Meta revises this page periodically.