Leaked Facebook Access Token: what to do in the first hour

• Hard-coded tokens in scripts. A script that posts to a page or pulls insights, with the token pasted in to skip an OAuth flow during development.
• Tokens in query strings. A request URL with access_token= in it, which then appears in logs, browser history and shared links.
• Debugging output. A copied response from the Graph API Explorer, or a screenshot of the Access Token Debugger, committed to a repository or posted in an issue.
• Environment files. A .env or configuration file holding the token next to the app secret, pushed to a public repository.
• Mobile and front-end bundles. A token compiled into an app or a web page that was published with source maps.

1. Identify the app and the account. Open the Access Token Debugger in your Meta developer account and check which app and which user or page the token belongs to. Note whether it is a user token, a page token or a system user token, because each one is removed in a different place.
2. Deploy a replacement before you remove the old token. Generate a new token through the normal login or the system user flow, store it in your secret manager, and confirm the integration still works.
3. End the exposed token. Removing the app’s access for the account ends its user tokens. For page and system user tokens, use the steps in the Facebook revoke section below, then confirm the old value no longer works in the debugger.
4. Review the activity. Look at the page’s recent posts, messages and ad activity for the period since the exposure. Check for content you did not publish and for changes to page roles.
5. Check the people with access. Review who holds roles on the page and on the business account. Remove anyone you cannot name a reason for, and check that the app is not listed with permissions you no longer need.
6. Reset the app secret if it leaked too. If the same file held the app secret, reset it in the app settings and update every server that uses it, since the secret is used to sign and exchange tokens.
7. Clean the repository. Remove the token from the working tree and rewrite history if the repository is public. See I accidentally pushed an API key to GitHub.

Not sure what else leaked? Run a free scan.

For a user token, open the apps and websites section of the account settings and remove the app. That ends the user’s grant, and the tokens issued through it stop working. For a page token, check the page’s roles and the business settings for the app or system user that the token belongs to, then remove the access or the token itself. Facebook’s developer dashboard shows the app’s settings, where you can also reset the app secret. Use the Facebook revoke section as a starting point, and if the menu names differ, follow Meta’s current documentation for managing app access. Changing the account password also ends many sessions, but do not rely on it alone.

The rule is called “Facebook Access Token”. It looks for a standalone run of 15 or 16 digits, a | or % separator, and then a body of 27 to 40 letters, digits, hyphens or underscores, with word boundaries on both ends. It has no context keyword, so it runs against every file and relies on the structure alone. A pattern with the separator replaced by a hyphen, a shorter body or a 14-digit prefix does not match. The severity is critical, because a user or page token can publish content and read data the grant covers. This type is not checked live: LeakWatch does not send any request to Facebook with the token it found, so a hit means the value has the right format, not that it still works.