Connect your ad account
Link a Meta ad account to a workspace with a System User token, and check the token has the permissions Win & Scale uses.
Win & Scale reads and writes one Meta ad account per workspace. Connecting it is a person's job: a workspace admin does it in the app. It cannot be done over MCP or REST, and Meta credentials never go through chat. If you offer an agent an access token, it should not repeat or use it.
Two ways to connect
| Way | Status |
|---|---|
| System User token pasted into the app | The path that works for every workspace today. |
| Continue with Facebook (Facebook Login for Business) | Shown only when it is configured on the deployment. Until Meta's App Review grants Advanced access, only people with a role on the Meta app can complete it. |
Both end in the same place: the token is verified against the ad account you pick, then stored encrypted. It is never shown again, and no API response returns it.
Connect with a System User token
Create the System User
In Meta Business Manager, open Business settings → System users and create a system user.
Assign its assets
Assign your ad account, your Page and your pixel to the system user. If the account has several Pages or pixels, assign the ones your ads use. A launch can choose another Page or pixel, and the workspace keeps one of each as its default.
Generate a token
Generate a token for the system user with at least ads_read and
ads_management. Add the other permissions in the table below for the features
you want. A System User token is issued without an expiry unless you pick one.
Paste it into Win & Scale
Open Settings → Meta connection (/app/settings/meta), or the token and ad-account steps
of onboarding for a new workspace. Paste the token, pick the ad account, and choose the default
Page and pixel from the lists Meta returns. Win & Scale verifies the token against
that account before it saves anything.
Permissions
The Meta connection page checks the token against this list and tells you which permission is missing. The right-hand column is what stops working without it.
| Permission | Area | Without it |
|---|---|---|
ads_read | Ads | Nothing syncs: performance, history and Insights all read through it. |
ads_management | Ads | Launches, activation and pausing are refused by Meta. |
pages_show_list | Pages | The Page token that comment filters and instant forms need cannot be exchanged. |
pages_read_engagement | Pages | Pages and their Instagram accounts are not listed; ids have to be typed. |
pages_manage_ads | Lead forms | Instant forms cannot be read, created or sent a test lead. |
pages_read_user_content | Comment filters | Comments under Facebook placements cannot be read. |
pages_manage_engagement | Comment filters | Comment filters cannot hide or delete on Facebook. |
instagram_basic | Comment filters | Comments under Instagram placements cannot be read. |
instagram_manage_comments | Comment filters | Comment filters cannot hide or delete on Instagram placements. |
The permissions check calls Meta's /me and /me/permissions with the token in
an Authorization header. It never puts the token in a query string.
After you connect
- The free trial starts. It starts at the first Meta connection, asks for no card, and runs once per ad account: reconnecting, or connecting a second workspace to the same account, keeps the first dates.
- History and a first sync are pulled. The lifetime history is pulled right after the connection responds, and every workspace backfills 90 days of daily data once after its first sync. See Sync and history.
- Values are proposed. A classifier reads creatives and proposes Values on the house taxonomy, which people then correct. See The creative taxonomy.
Reads work as soon as the first sync lands. Check them with
GET /api/v1/evidence-health or
meta_get_evidence_health, which says what is not in yet.
If the token stops working
Paste a new token on the same page. Only a workspace admin can change the credentials; other members see the connected ad account id and nothing more.