Messenger Platform · error code

Messenger error 10: Application does not have permission for this action

ConfigurationHTTP 403Permissions, app review & thread control

Last verified against Meta for Developers - Messenger Platform error codes

What Messenger returns
Application does not have permission for this action

What error 10 means

Bare code 10, no subcode, is the Graph API's feature-level permission denial: "API Permission Denied. Permission is either not granted or has been removed." On the Messenger Platform it covers the cases where the app is intact and authenticated but the specific action is off-limits: calling the User Profile API for PSIDs the app cannot access (Meta's table notes it is "not available for PSIDs associated with Instant Game Pages"), invoking features the app was never granted, or acting on threads and objects that belong to another capability tier.

The critical reading instruction: code 10 is the most overloaded number in the Messenger catalogue, and the subcode changes the diagnosis entirely. With 2018278, 2534022 or 2018065 it is the 24-hour messaging window, not permissions. With 2018108 it is an unreachable recipient. With 1893015 the person stopped a notification topic, and with 1404170 the Page is restricted from opt-in requests. Only the bare code, or unrecognized subcodes, should route to permission handling.

Distinguish it from the OAuth-scope error 230 (the token lacks pages_messaging) and the App Review wall 200 (permission exists, review does not). Bare 10 typically means the action itself, this endpoint, this field, this object, is outside what your app may do, which is fixed by requesting the right feature or permission, or by not calling that endpoint for that object class.

What it looks like

{
  "error": {
    "message": "(#10) Application does not have permission for this action",
    "type": "OAuthException",
    "code": 10,
    "fbtrace_id": "BLBz/WZt8dN"
  }
}

Why it happens

  • Calling the User Profile API or another endpoint the app has no granted permission for.
  • Requesting profile fields beyond the granted set (name and picture are the defaults; more requires approval).
  • Acting on object classes that are excluded, such as PSIDs from Instant Games Pages.
  • A previously granted permission removed during re-authorization or a Meta enforcement action.
  • Routing every code-10 response to one handler, misdiagnosing window errors as permission errors.

How to fix Messenger error 10

  1. 1Branch on error_subcode first; only handle bare 10 as a permission problem.
  2. 2Check the App Dashboard's Permissions & Features for the permission backing the failing endpoint and its access level.
  3. 3Verify the token's granted scopes in the Access Token Debugger; re-authorize with the missing scope if absent.
  4. 4For profile-field denials, request only default fields or apply for the additional ones via App Review.
  5. 5If the object class is excluded by policy (e.g. Instant Games PSIDs), remove the call path rather than retrying.

How to stop it recurring

Keep a manifest of which Graph permissions each code path relies on, and assert them against the live token at startup. Never write a catch-all handler for code 10, always subcode-dispatch, or window errors will masquerade as permission bugs for hours of debugging. The permission chain and its failure modes are walked in the Messenger troubleshooting guide, with the profile-API limits in the limits reference.

Official reference: Meta for Developers - Messenger Platform error codes. See all Messenger error codes or the Messenger limits and quotas.

Related codes

Error 10 - quick answers

What does Messenger error 10 mean?

Bare code 10, no subcode, is the Graph API's feature-level permission denial: "API Permission Denied.

How do I fix Messenger error 10?

1. Branch on error_subcode first; only handle bare 10 as a permission problem. 2. Check the App Dashboard's Permissions & Features for the permission backing the failing endpoint and its access level. 3. Verify the token's granted scopes in the Access Token Debugger; re-authorize with the missing scope if absent. 4. For profile-field denials, request only default fields or apply for the additional ones via App Review. 5. If the object class is excluded by policy (e.g.…

Stop debugging Messenger by hand

Connect the channel through Conferbot: tokens, webhooks and retries are handled, failures show as readable status.