Meta / Facebook SSO: Client-managed setup

Misty Flowers

September 23, 2026 18:29

This article guides setup of Facebook as a client-managed identity provider for signing into Finalsite, including what to configure in Meta for Developers and which values to send to Finalsite to complete the connection.

💡Quick answers

What is this setup used for? Signing into Finalsite using a personal Facebook account, most commonly for community-facing areas such as alumni portals and parent engagement areas, with the school's own IT team keeping full control over the connection.
Which protocol does it use? OAuth 2.0 via Facebook Login. This connection does not use SAML.
What access is needed before starting? A Facebook account with admin rights in Meta for Developers, and permission to create apps on behalf of the school's organization, or access to a colleague who can.
What does Finalsite need at the end of setup? Two values: the App ID and the App Secret, sent over a secure channel rather than email.
What happens if a user declines to share their email? Facebook lets users opt out of the email permission individually at sign-in. Without it, Finalsite cannot match the account, and the user will need to retry and grant the permission.
Is this the only way to set up Facebook sign-in? No. Schools that do not need this level of control can use the Quick Setup with Finalsite option instead, which requires no configuration on the school's side.

Facebook Login lets someone sign in using their existing Facebook account instead of creating a new one. Not familiar with it? Meta's own overview of Facebook Login covers the basics of how it works. Setting it up as a client-managed identity provider lets a school's own IT team register and control the Facebook application Finalsite uses, rather than relying on a connection Finalsite manages by default.

Facebook is most commonly used for community-facing sign-in, such as alumni portals, parent engagement areas, and other public-audience content, rather than for staff or administrative accounts; schools authenticating staff with their existing school identity should use the Microsoft Entra ID or Google Workspace guides instead. This guide walks through registering an app in Meta for Developers, generating the values Finalsite needs, and where to go if something stops working.

When to use this setup
Before starting
Step 1: Create a new app in Meta for Developers
Step 2: Add the Facebook Login product
Step 3: Configure the OAuth redirect URI and app domains
Step 4: Capture the App ID and App Secret
Step 5: Confirm the permissions Finalsite needs
Step 6: Switch the app to Live mode
Step 7: Send the values to Finalsite
Troubleshoot common issues
Alternative: Quick Setup with Finalsite

Am I eligible, and how does this work?

This setup is available to schools that want to let community members, such as parents, alumni, or prospective families, sign in with their own Facebook account, and want full control over the Meta for Developers app Finalsite uses. Schools that do not need that level of control can skip this guide entirely and request the Quick Setup with Finalsite option instead, which requires no configuration on the school's side.

Once set up, this works as a sign-in option, not a data sync. Instead of typing a Finalsite password, someone can choose to sign in with their Facebook account. Facebook checks who they are and sends Finalsite a confirmation; Finalsite never sees or stores the Facebook password.

Setting this up requires registering an app in Meta for Developers and sending Finalsite two values from that registration: an App ID and an App Secret. The steps below cover exactly what to do and where to find each value.

When to use this setup

Use this setup when a school wants to let community members sign in with their own Facebook account and requires full control over the Meta for Developers app Finalsite uses for authentication. Facebook is best suited to community-facing areas rather than staff or administrative sign-in; see the Microsoft Entra ID or Google Workspace guides for staff use cases. Schools that do not need this level of control can request the Quick Setup with Finalsite option instead; it requires no configuration on the school's side and is enough for most schools.

Before starting

Confirm access to the following before beginning:

A Facebook account with admin rights in Meta for Developers
Permission to create apps on behalf of the school's organization in Meta for Developers
A Facebook Business Account is recommended but not required for the default permissions used in this setup

Finalsite also provides one value needed during setup:

Redirect URI: https://auth-us-east1.finalsite.com/oauth2/callback

⚠️ Important Note

Two Facebook-specific behaviors catch most teams off guard. New apps start in Development mode, where only Facebook users listed as developers, testers, or admins on the app can sign in; real community users cannot sign in until the app is switched to Live mode in Step 6. This is the most common reason a Facebook setup appears to work in testing and then fails for real users.

Facebook also lets a user decline the email permission individually at sign-in, even though Finalsite requests it. Without an email address, Finalsite cannot match the user to an account, so the sign-in will fail; the user will need to retry and grant the permission.

Step 1: Create a new app in Meta for Developers

Sign in to Meta for Developers with a Facebook account that has admin rights for the school's organization.
In the top navigation, click My Apps, then click Create App.
When prompted for an app use case, choose Authenticate and request data from users with Facebook Login, then click Next.
Fill in the app details:
- App name: Finalsite SSO, or a name that helps identify it later; this is displayed during sign-in.
- App contact email: an email address Meta can reach the school at.
- Business portfolio: select the school's business portfolio if one exists; otherwise leave as No Business portfolio.
Click Create app. Meta may ask for the Facebook password again to confirm.

Need more help? Visit Meta's guide: create an app in Meta for Developers.

Step 2: Add the Facebook Login product

From the app's left menu, locate the Add products to your app section.
Find Facebook Login and click Set up.
When asked to choose a platform, select Web.
Meta walks through a quickstart; the SDK setup steps can be skipped, since Finalsite does not use the Facebook JavaScript SDK on the school's site.

Step 3: Configure the OAuth redirect URI and app domains

From the left menu, select Facebook Login → Settings.
Locate the Valid OAuth Redirect URIs field and paste the redirect URI Finalsite provided: https://auth-us-east1.finalsite.com/oauth2/callback
Make sure Client OAuth Login and Web OAuth Login are both toggled on, then click Save Changes.
From the left menu, go to App settings → Basic.
In the App Domains field, add the bare hostname auth-us-east1.finalsite.com (no protocol); this is the domain Facebook will permit the OAuth redirect to live on.
Click Save Changes.

Step 4: Capture the App ID and App Secret

From the left menu, select App settings → Basic.
Copy the App ID displayed at the top of the page.
For the App Secret, click Show next to the masked value; Meta will ask for the Facebook password again to confirm.
Copy the App Secret somewhere secure; it gets sent to Finalsite at the end of this guide.

Step 5: Confirm the permissions Finalsite needs

Facebook grants two permissions to every app by default. The typical set Finalsite requests is email and public_profile. Both are default Facebook permissions and do not require Meta App Review.

Check with IT before relying on this permission set

Confirm the permission set above with the school's IT Tech Lead before relying on it. Some organizations restrict which Facebook permissions can be granted to third-party applications. If a different set is approved, let the Finalsite contact know; the email permission is required for Finalsite to match users to the school's accounts, so reducing the set below the default may break sign-in. If Finalsite needs additional permissions for a specific use case, those get requested under App Review → Permissions and Features and require Meta's review before they become usable in production.

Need more help? Visit Meta's permissions reference.

Step 6: Switch the app to Live mode

By default, Meta creates new apps in Development mode. Only users listed as developers, testers, or admins on the app can sign in until it's switched to Live.

In the top navigation bar of the app dashboard, locate the App Mode toggle; it shows Development.
Click the toggle to switch the app to Live.
If Meta prompts for a privacy policy URL or asks to confirm a few details, complete those prompts before the switch takes effect.

Need more help? Visit Meta's guide: Development and Live app modes.

Step 7: Send the values to Finalsite

Send the Finalsite contact the following two values. Use a secure channel; the App Secret is sensitive and should not be shared by email.

Field	Where to find it
App ID	App settings → Basic
App Secret	App settings → Basic (click Show)

Finalsite uses these values to configure the connection, tests it, and confirms once sign-in is working for the school's users.

Troubleshoot common issues

"URL Blocked: This redirect failed because the redirect URI is not whitelisted in the app's Client OAuth Settings." The redirect URI in Facebook Login → Settings → Valid OAuth Redirect URIs does not match what Finalsite is sending. Verify the URI character for character (it must be exactly https://auth-us-east1.finalsite.com/oauth2/callback unless Finalsite has said otherwise) and click Save Changes.
"App not active: This app is not currently accessible and the app developer is aware of the issue." The app is still in Development mode. Return to Step 6 and switch the app to Live mode; a privacy policy URL may be required first.
"Login failed — the email permission was not granted by the user." The user declined to share their email address during sign-in. Facebook allows users to opt out of individual permissions; Finalsite cannot create or match an account without an email address, so the user will need to retry and grant the email permission.

Alternative: Quick Setup with Finalsite

Schools that do not need this level of control, or would rather not manage a Meta for Developers app, can request the Quick Setup with Finalsite option instead. It requires no configuration on the school's side and is enough for most schools.