Connect a Facebook Page so Ashley can draft posts, publish up to 10 photos in one post, and read your Page insights. Four permissions, three deliberately refused, and nothing goes out without your tap.
Connect a Facebook Page and Ashley writes the post. You tap publish.
Ashley drafts the caption, the hashtags and the image, and hands you an editable card. One tap sends it to your Page - a text post, a single photo, or a real multi-photo post with up to 10 images. She also reads your Page insights so her advice comes from your numbers, not from a blog post about "the best time to post in 2026".
She cannot read your Page's comments. She cannot read your Page's messages. She never publishes on her own. Those aren't settings - they're permissions we didn't ask Facebook for, and a publish path that requires a user session.
The one thing to know
Ashley drafts. You publish. There is no unattended posting in Unyo - the publish path requires you to be signed in and to tap the button on the card. Even an automation that runs at 7am while you're asleep prepares the draft and stops there.
What connecting a Page unlocks
Facebook is Ashley's integration. She's the only agent with a social toolbox - and she is blocked at the runtime layer from touching your inbox, so an email agent and a social agent never quietly swap jobs.
Draft - no connection needed
You can draft before you connect anything. Ask Ashley for a post and you get a complete card in the chat: caption, hashtag chips, a generated image, per-platform preview tabs and a live character count. Editable in place. The Facebook toggle simply stays greyed out until a Page is connected.
Publish - one tap, three post shapes
| What you send | What Unyo does on Facebook |
|---|---|
| Caption only | A text post on your Page's feed |
| Caption + 1 image | A photo post |
| Caption + 2–10 images | A real multi-photo post (attached_media), not 10 separate posts |
The card gives you drag-and-drop reordering before you send. If you also target Instagram, LinkedIn or X in the same draft, each platform gets its own correct API flow, they publish in parallel, and one platform failing never blocks the others - you get a per-platform result and a real permalink for whatever worked.
Read your Page's numbers
Ask, don't dig:
- Followers and follower change over the period
- Reach, impressions, page views
- Engagement rate, average likes and comments per post
- Your top posts, with likes, comments, reach, impressions, saves and shares
- Your best hour and best day to post, your top 5 hours, a 7-day breakdown, which content types work, and your top 10 hashtags
All of it is computed from your own posts. Ashley's "post on Thursday at 6pm" comes from a 24-hour × 7-day engagement map of your Page, not an invented benchmark. If there's no data yet, she says so instead of making something up.
Reels
A Reel can be published to your Page from a video you already have. Facebook Reels use their own endpoint and their own flow.
Facebook is independent from Instagram
Unyo runs two separate Meta apps and two separate OAuth flows. You can connect a Facebook Page without connecting Instagram, and connect Instagram without owning a Facebook Page. Most tools force you through the old bundled flow. We don't.
Connect your Page
- Open Integrations from the sidebar. (It's a top-level route - not inside Settings.)
- Filter to Social, or search for Facebook.
- Click Connect on the Facebook card.
- Sign in with the Facebook account that administers the Page, and complete Facebook Login for Business.
- Choose the Page you want Unyo to work with, and review the permissions Facebook shows you.
- You land back on
/integrations. The card now shows your Page name - that's how you know which Page is live.
If an agent hits the wall first - you ask for a post and Facebook isn't connected - the chat offers you a Connect button that drops you straight into this flow, and brings you back to the same conversation afterwards.
Permissions - what we ask for, and what we refuse
Unyo requests four permissions on your Page. Each one exists because a specific feature needs it.
| Permission | What it lets Ashley do, in plain English |
|---|---|
pages_show_list | See which Pages you administer, so you can pick the right one at connect time |
pages_manage_posts | Publish the post you tapped publish on - text, photos, multi-photo |
pages_read_engagement | Read likes, comments, reach and shares on your Page's posts, so the analytics are real |
read_insights | Read your Page insights - followers, reach, impressions, page views |
Deliberately not requested
| Permission we refuse | What that means you're safe from |
|---|---|
pages_messaging | Unyo cannot read or send your Page's messages. Your Messenger inbox is invisible to us. |
pages_read_user_content | Unyo cannot read comments people leave on your Page, or the content your visitors post to it. |
business_management | Unyo cannot touch your Business Manager - no assets, no ad accounts, no people, no settings. |
We didn't skip these to save time. They're not needed for what Ashley does, and a permission you never grant is the only permission that can never be misused. Same posture across the platform: Google Drive runs on per-file access only, Shopify is read-only by grant, and Stripe has no charge, refund or payout code path at all.
Whichever Page you picked is the Page
pages_show_list lets us list your Pages so you can choose one at connect time. The card then displays that Page's name permanently. If you administer several Pages and picked the wrong one, disconnect and reconnect - it's a 20-second round trip.
What Unyo does with your Facebook data
- Your Page tokens are encrypted at rest. They go through a database-level encryption function and are never written to or read from a plain column. As of 16 July 2026, a live check of every populated OAuth token column across Unyo - 17 of 17 - confirmed AES-256 encryption at the cipher-byte level. Zero plaintext tokens exist.
- A token never appears in a log, an error message, an HTTP response or a chat stream. It's resolved for the duration of one outbound call and then dropped.
- Publishing and page-management calls to Facebook are signed with
appsecret_proof- an HMAC of the token with our app secret. It's a CASA Tier 2 requirement that most integrations quietly skip. - The Graph API version is pinned in exactly one place, and our policy is to never run a version less than six months old. No bleeding-edge breakage on your Page.
- No model is trained on your data. Every model Unyo runs is under a no-training, zero-retention guarantee.
- Your connection row is protected by row-level security - 109 of 109 public tables have RLS, with 291 policies, verified live on 16 July 2026 - and cascades on account deletion.
- An independent CASA Tier 2 dynamic security test (TAC Security, 6 May 2026) returned 0 Critical, 0 High, 0 Medium.
Try it
Make me a Facebook post with 5 photos showing our new summer menu - I want it as one carousel-style post, not five posts.
Scheduling
Schedule from the card, not from the conversation. Once the draft is ready, open the schedule control on the post card, pick a date and time in your own timezone, and confirm. An internal scheduler checks for due posts every minute and publishes within the minute of its due time.
Once a post is queued, Ashley can manage it conversationally:
Scheduling is built to survive failure: per-job locks with stale-lock recovery, retries with backoff on transient errors only, a hard cancel check immediately before publishing, and an expiry so a stuck post never surprises you days later. Publishing is idempotent by construction - a fingerprint of the content is the job key, so a double-click or a flaky network gets you the same job back, never a double post.
After you publish
Optionally, a successful publication can cascade into the rest of your stack: a formatted summary saved to Google Drive, a page in your Notion content library, an announcement in Slack. It's strictly opt-in - if you never turn it on, nothing runs.
You can also ask Ashley to save the post's images into a colour-coded folder in your Neural Core, each stored with the prompt that generated it. Anything in the Neural Core is readable by all 10 agents, so the next agent that needs your brand imagery already has it.
Limits worth knowing
| Limit | Value |
|---|---|
| Images per Facebook post | 10 |
| Facebook caption length | 63,206 characters |
| Hashtags Ashley targets for Facebook | 10 |
| Facebook Pages per connection | 1 - the one you picked |
| Page token lifetime | 60 days, refreshed daily by Unyo |
Staying connected
Facebook Page tokens last 60 days. A daily job rolls yours over before it expires, so in normal use you connect once and forget it.
If a refresh fails - you changed your password, an admin removed the Page, Facebook invalidated the grant - the connection flips to Reconnect required and the card shows a Reconnect button. You get a button, not a silent failure and a post that never went out.
Disconnecting and revoking
Click Disconnect on the Facebook card in /integrations. Two things happen:
- Unyo asks Facebook to revoke the grant. We call Facebook's permissions-delete endpoint with your stored user token.
- The local connection row is deleted regardless.
Here's the honest part: if step 1 fails, we still do step 2. We delete the row so the interface never lies to you about being connected - but that means there is a case where Unyo shows "disconnected" and the grant still exists on Facebook's side. If you want certainty, remove Unyo yourself in Facebook → Settings & privacy → Settings → Business integrations. That's the source of truth, and it always wins.
The reverse also works cleanly: revoke Unyo from Facebook's own settings and the card updates itself immediately, no page refresh. We subscribe to the change and flip the card from Connected back to Connect while you're looking at it.
Deleting your Unyo account is the thorough path - it revokes every provider grant that offers an API for it, takes any published site offline first, and purges around 80 tables atomically, including every connection row.
Will Ashley post to my Page on her own?
No. There is no unattended publishing in Unyo, on any platform. The publish path requires your signed-in session and your tap on the card. Automations are explicitly built to draft and stop - an automation that runs while you're asleep prepares the post and waits for you. It's also why voice can draft a post but can't publish one: you have to tap the card.
Can Unyo read or reply to comments and messages on my Page?
No, and we can't add it by flipping a switch. We never requested pages_read_user_content (comments and visitor posts) or pages_messaging (Messenger). Those permissions don't exist on your connection, so the data is unreachable - not filtered, unreachable. What Ashley reads is aggregate engagement: how many likes, comments, shares and how much reach a post got, never who wrote what.
Do I need a Facebook Page to use Instagram with Unyo?
No. They're two independent connections through two separate Meta apps. Connect either one alone, or both. If you connect both, one draft can publish to both at once - each through its own correct API flow.
Can I connect several Facebook Pages?
One Page per connection. You pick the Page during the Facebook Login for Business flow, and the card shows its name so you always know which one is live. To move to a different Page, disconnect and reconnect.
What does publishing to Facebook cost in credits?
Drafting a post, reading your analytics and listing what's scheduled are free operations. What you pay for is the model's real work on the run - Unyo bills on real cost, not per message. You start with 2,500 free credits and no card.
Is my Page data used to train AI models?
No. Every model Unyo runs is under a no-training, zero-retention guarantee, and your Page tokens are encrypted at rest and never appear in a log, an error or a chat stream.
Troubleshooting
The connect window opens and closes with nothing happening. Allow pop-ups for the sign-in window, and make sure you're signed into the Facebook account that administers the Page. The connect link expires quickly by design - if you left the tab open for a while, go back to /integrations and start again.
The card says "Reconnect required". Your 60-day Page token couldn't be refreshed. Click Reconnect and complete the flow - you'll be back in under a minute. Nothing else is affected.
A post failed on Facebook but worked on Instagram. That's the intended behaviour. Platforms publish in parallel and report independently - a Facebook failure never blocks an Instagram success. The card shows you the per-platform outcome and what to do about the one that failed.
Ashley says she has no Facebook data. Analytics come from your own Page, so a brand-new or quiet Page has little to compute from. She'll tell you a metric is unavailable rather than invent it. If your numbers are more than six hours stale, a tool call refreshes them automatically before answering.
I disconnected but Facebook still lists Unyo. See Disconnecting and revoking above - remove the integration in Facebook's own settings to be certain. That's the source of truth.
I picked the wrong Page. Disconnect and reconnect, then pick the right one at the Facebook step.
Related: Instagram · Social publishing · Social analytics · Ashley · Security and privacy