Meta’s “Invalid Scopes” error usually means the login dialog asks for a permission that is not yet part of the app’s use case, or is deprecated; Meta then refuses the whole dialog. It is not about the order of scopes. Request only permissions your use case includes, and include each one’s prerequisites from Meta’s Permissions Reference.
Key takeaways
- Meta refuses the whole login dialog when one requested permission is not in the app’s use case; it is not an ordering problem.
- pages_manage_posts needs pages_read_engagement and pages_show_list; instagram_content_publish needs instagram_basic, pages_read_engagement and pages_show_list.
- instagram_basic itself needs pages_read_user_content and pages_show_list, so the Instagram chain reaches two Page permissions.
- Instagram Login uses a separate chain: instagram_business_content_publish needs only instagram_business_basic. Pick one login flow.
On this page
What causes Meta’s “Invalid Scopes” error?
A permission in the login request that the app is not set up to ask for. SkedCast met this building its own Facebook connection: when the dialog asked for a permission not yet added to the app’s use case, Meta rejected the whole dialog with “Invalid Scopes”, not just that one permission. That is why SkedCast keeps two Page permissions out of the request until they are approved. Meta’s Permissions Reference describes dependencies, not an order to request scopes in, so reordering the list does not help.
Which permissions does a scheduling app need, and what do they depend on?
A permission works only when its prerequisites are approved and granted too, so a submission for pages_manage_posts or instagram_content_publish should carry the whole chain.
| Permission | What it allows | Depends on |
|---|---|---|
| pages_show_list | List the Pages a person manages | Nothing |
| pages_read_engagement | Read Page posts, followers and metadata | pages_show_list |
| pages_manage_posts | Create, edit and delete Page posts | pages_read_engagement, pages_show_list |
| pages_read_user_content | Read comments and posts by others on the Page | pages_show_list |
| instagram_basic | Read an Instagram professional account’s profile and media | pages_read_user_content, pages_show_list |
| instagram_content_publish | Publish Instagram posts and Reels | instagram_basic, pages_read_engagement, pages_show_list |
| instagram_business_content_publish | Publish through Instagram Login | instagram_business_basic |
Should you use Facebook Login or Instagram Login for Instagram?
One of them, not both. Meta documents two routes to Instagram publishing: the Facebook Login route, where instagram_content_publish sits on the Page permissions above, and Instagram Login, where instagram_business_content_publish needs only instagram_business_basic. The two chains do not mix, so an app that asks for permissions from both in one request invites scope errors. SkedCast connects Instagram through Facebook Login for Business, where a configuration carries the permissions instead of a scope list. See how SkedCast connects Instagram and the platform permissions tool for every network.
How do you prepare an App Review submission that passes?
Before submitting, check which access level each permission needs in the publishing API access matrix.
Add each permission to the use case
In the app dashboard, add every permission the login will request to the app’s use case before it appears in the dialog.
Include the prerequisites
Request and submit each permission with the ones it depends on, from the table above.
Describe the use
For each permission, give a specific example of why your app needs it, as Meta’s review form asks.
Record the screencast
Show the complete login, the permission being granted, and the feature that uses it.
Who sees the Invalid Scopes error?
The person trying to log in sees Meta refuse the dialog, and the developer sees the error in the OAuth response. A permission that is in the use case but declined by the user is different: the login completes and the permission is simply missing from what was granted, which your app should check after every connect.
Sources
FAQ
- Does pages_manage_posts need any other permission approved alongside it?
- Yes. It depends on pages_read_engagement and pages_show_list, per Meta’s Permissions Reference, so request and submit all three.
- What does instagram_content_publish depend on?
- instagram_basic, pages_read_engagement and pages_show_list; instagram_basic in turn depends on pages_read_user_content and pages_show_list.
- Should I use instagram_content_publish or instagram_business_content_publish?
- The one that matches your login: instagram_content_publish with Facebook Login, instagram_business_content_publish with Instagram Login. Do not mix the two chains in one request.
- Does the order of scopes cause the Invalid Scopes error?
- No. Meta describes dependencies, not an order. The error comes from a permission the app’s use case does not include, or a deprecated one, and Meta then refuses the whole dialog.
- Who sees the "Invalid Scopes" error message?
- The person logging in sees the dialog refused, and the developer sees the error in the OAuth response. A permission the user declines is just missing from the grant, with no error.
- What is the base permission every Page-publishing chain depends on?
- pages_show_list, which has no dependency of its own and returns the list of Pages a person manages.
- How current is this permissions list?
- Read from Meta’s Permissions Reference on 6 November 2026, which Meta last updated on 19 October 2026. Meta revises it from time to time, so check the live page before you submit.