Messenger error 10: Outside window - News Messaging permission required

Code 10 with subcode 2018065 is a window violation with a specific escape hatch named in the message. The send arrived after the 24-hour standard messaging window closed, and the one capability that would have allowed this particular pattern, News Messaging, is not granted to your app. Meta's current error-codes table quotes it as "This message is sent outside of allowed window. You need News Messaging permission to be able to do it"; older documentation returned the same subcode citing the retired pages_messaging_subscriptions permission, which is why long-running codebases often still map 2018065 to "subscription messaging."

News Messaging is Meta's program for registered news publishers, organizations listed in the Facebook News Page Index (NPI), to send non-promotional news updates to people who subscribed. It is under development, invite-gated, and not something a typical business bot can or should apply for. If your Page is not a registered news publisher, the permission half of the message is a dead end, and you should treat 2018065 exactly like the generic window error 10/2018278: the person has not interacted within 24 hours, so untagged sends are off the table.

What is NOT wrong: your token, your pages_messaging approval, and the recipient. The API found everything in order except the timing and the missing program membership. Bots that inherited broadcast lists from the pre-2020 subscription-messaging era hit this constantly, because the old permission allowed exactly the recurring, non-promotional pushes that now require either the News program or per-user opt-ins. The modern alternatives, one-time notifications, marketing-message opt-ins, sponsored messages, are compared in the Messenger limits reference.

{
  "error": {
    "message": "(#10) This message is sent outside of allowed window. You need News Messaging permission to be able to do it.",
    "type": "OAuthException",
    "code": 10,
    "error_subcode": 2018065,
    "fbtrace_id": "BLBz/WZt8dN"
  }
}

Run every outbound message through the same window gate as 2018278 and choose the channel at send time: untagged inside the window, opt-in token or HUMAN_AGENT outside it, nothing otherwise. If your product genuinely needs recurring updates, collect the opt-in while the person is engaged rather than assuming a permission will cover you later. The whole window-and-tags decision tree is laid out in the limits reference and narratively in the troubleshooting guide.