For Meta App Reviewers

Step-by-step testing instructions · App ID 1680764243166534

This is a single-operator internal tool. Vivek Pujari is the sole authenticated user. There is no public signup. All testing happens against the operator’s own Instagram Business accounts and Facebook Pages, which the operator owns and administers.

1. Confirm the OAuth flow

Visit the public landing page: https://ig.learn3dfashion.com
Click the Continue with Facebook button in the top-right navigation (or on the hero). You will be redirected to facebook.com/v25.0/dialog/oauth with the operator’s App ID (1680764243166534) and the requested scopes visible in the consent dialog.
The requested permissions are: instagram_basic, instagram_content_publish, instagram_manage_messages, instagram_manage_comments, instagram_manage_insights, pages_show_list, pages_read_engagement, pages_messaging, pages_manage_metadata, business_management.
After authorization, the OAuth callback at /oauth/meta/callback exchanges the code for a long-lived User Token, fans out to per-Page Access Tokens, encrypts them with Fernet (AES-128-CBC + HMAC-SHA256) and persists them in Postgres. The reviewer is redirected to the dashboard.

2. Reach the dashboard

The dashboard at /dashboard is protected by HTTP Basic Auth. Demo credentials for the reviewer are provided in the App Review submission form’s App Verification Details field (not shown publicly on this page).

Once signed in, the reviewer can verify:

/dashboard — overview, shows backend reachability check.
/dashboard/accounts — list of connected Instagram Business accounts with their Page IDs and IG User IDs.
/dashboard/posts — list of scheduled and published posts with timestamps and Instagram media IDs.
/dashboard/inbox — list of inbound conversations.
/dashboard/insights — per-post performance leaderboard.

3. Permission-by-permission verification

`instagram_content_publish`

A real Instagram Reel published from this app on @learn3dfashion is the proof artifact. The publishing flow recorded in the submission screen recording mirrors what reviewers can verify by inspecting /dashboard/posts and following the timestamp to the Instagram profile.

`instagram_manage_messages`

Reviewers should DM the connected Instagram Business account from a Tester account (the reviewer’s Tester role on this app grants them access). Within ~30 seconds the dashboard’s /dashboard/inbox will show the inbound message and the auto-reply that was sent. The reply text is also visible in the reviewer’s Instagram inbox.

Compliance notes:

Replies are sent only within the standard 24-hour messaging window. The Send API call uses MESSAGE_TAG=RESPONSE; the HUMAN_AGENT tag is never used.
Per-sender rate limit: max 10 replies per hour. The 11th inbound from the same sender within an hour is logged as skip_reason=rate_limited and not replied to.
OpenAI content moderation runs on inbound and outbound text. Anything flagged is logged with skip_reason=moderation and no reply is sent.
The dashboard contains an opt-out toggle per account; flipping it off stops all auto-replies for that account.

`instagram_manage_comments`

Reviewers can comment on any post on the connected Instagram Business account (e.g., the Reel published for the publish permission test above) from a Tester profile. Within ~30 seconds the comment appears in /dashboard/inbox with channel=ig_comment, and the auto-reply lands on the same comment thread on Instagram.

`instagram_manage_insights`

Visit /dashboard/insights. The leaderboard shows reach, likes, comments, saves, and views for posts published in the last 30 days. Data is pulled by a background worker at the +1h, +24h, +7d, and +30d horizons after each publish via GET /<ig_media_id>/insights.

4. Webhook delivery

The webhook receiver at https://web-production-6f69ec.up.railway.app/webhooks/meta implements both:

GET — subscription handshake. Echoes back hub.challenge only when hub.verify_token matches the configured token (rejects with 403 otherwise).
POST — event delivery. The raw body is verified against the X-Hub-Signature-256 header using HMAC-SHA256 with the Meta App Secret before any side-effect. Bad-signature events still return 200 (per Meta’s expectation, to avoid retry storms) but are not processed; they are persisted to the webhook_events audit table for forensic review.

5. Data deletion

See /data-deletion. The tool provides a Data Deletion Instructions URL (acceptable per Meta’s requirements). A user can email architectpujari@gmail.com with subject Data Deletion Request to have all their stored interactions removed within 30 days.

6. Contact

For any questions about this submission:
Email: architectpujari@gmail.com
Operator: Vivek Pujari

What is "Learn3D Studio"?

The App Display Name in the Meta dashboard may show as my-automations (the working name). The public-facing brand name on the website is Learn3D Studio. Both refer to the same single-operator tool described above. Either name in your communications is fine.