Security
Which scopes Doorman requests on Instagram and Facebook and why each one is needed, how webhook signatures are verified, how access tokens sit encrypted with AES-256-GCM, and what happens when a token expires.
Published · September 3, 2026 · Tim Urbutt · 9 min read
01
When you connect a channel, Meta shows you a list of permissions. Most tools do not explain them, and the list is not self-explanatory. So here is what each scope is for - and what would not work without it.
| Scope | What for |
|---|---|
| instagram_business_basic | Identify the connected account and its posts, so a comment can be attributed to the right post and the right channel. |
| instagram_business_manage_comments | Read, hide, unhide and reply to comments. This is the moderation itself. |
Facebook does not run through a scope list but through a Login for Business configuration. The difference is not cosmetic: a configuration always renders the same dialog with asset selection, instead of letting Meta choose which consent UI to show. That is what makes it reliable to see which pages you are granting.
| Permission | What for |
|---|---|
| pages_show_list | List the pages you administer so you can pick one. |
| pages_read_engagement | Read the page's posts and comments - the context a comment is judged in. |
| pages_read_user_content | Read user-generated content on the page, which is the comments themselves. |
| pages_manage_engagement | Hide, unhide and reply to comments. |
| pages_manage_metadata | Subscribe to the page's comment notifications. Without that subscription there is no event to react to. |
| business_management | Only on the Business Portfolio path, so Meta can grant the app a system user inside the portfolio. |
The only write access Doorman ever exercises is hiding comments and - where you switched replies on - replying to them.
02
Processing is event-driven: Meta delivers as soon as somebody comments. A publicly reachable endpoint that triggers moderation decisions on request is, without verification, an invitation. That is why the signature check comes before anything else.
03
A Meta access token is the key to your channel. It is therefore not stored in clear text but encrypted with AES-256-GCM. GCM is not a detail for cryptographers here: the mode provides integrity as well as confidentiality - a tampered record does not decrypt into something else, it does not decrypt at all.
Tokens expire, and a tool moderating around the clock must not lose access because somebody changed a password. The state of every connected channel is therefore monitored: if a token expires or is revoked, the channel is marked as disconnected and you are notified. What does not happen is quiet continuation on a dead credential - moderation that has stopped working without saying so is worse than moderation that pauses.
04
For every comment checked, the record holds when it was judged, how it was judged and which of your rules matched. That is the basis for two things at once: your own traceability, and the answer you have to be able to give a data subject.
Once the retention window has passed, what is left of that record is the history without text and without names. Your analytics build on it. Because nobody can be reconstructed from it, that remainder is no longer processing of personal data.
05
No. The permissions requested cover reading posts, reading, hiding and replying to comments, and subscribing to comment notifications. Publishing, editing and deleting posts is not among them, and neither are direct messages or ad accounts.
The stored access token is removed and processing for that channel stops immediately. You can disconnect and clean up a single channel without giving up the account; deleting the account removes every personal record along with uploaded files and stored channel access.
Every inbound event from Meta and from the payment provider carries a signature, verified against the raw request body and in constant time. If verification fails the event is discarded and never reaches processing.
No - Doorman never sees your password. The connection runs through Meta's own login dialog, which ends in an access token. That token is what we store, encrypted with AES-256-GCM, and the key does not live in the database.
06
Last reviewed: 3 September 2026. Permissions change when Meta changes its APIs; this article is updated along with them.
Write to us — we are happy to help with a concrete answer.
Nordify UG (haftungsbeschränkt), Hamburg