Is AdsMeta — Facebook Ads Manager safe?
AdsMeta reads your Facebook ad-account access token from facebook.com and shares it with its own adsmeta.io dashboard.
To power its ad-manager features, AdsMeta extracts the long-lived Facebook Graph API (EAA) access token tied to your ad accounts. Its service worker fetches Facebook pages with your session cookies and scrapes the token from the page HTML, caching it for 12 hours, and hands it to the adsmeta.io web dashboard when that site asks for it. A content script also writes the token into the page's sessionStorage on facebook.com, where any script running on that page can read it. External access to the token is restricted to the vendor's own adsmeta.io origins.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Service worker fetches Facebook using your cookies to harvest an access token
We observed the background service worker send a credentialed request to Facebook using your browser's own session cookies, with no Facebook tab open, then read your access token from the response.
You open the AdsMeta dashboard at adsmeta.io more than 12 hours after your Facebook token was last refreshed.
No Facebook tab needs to be open in the browser.
The background service worker sends a credentialed GET request to Facebook's Ads Manager using your browser's session cookies.
It then parses the returned page for an access token and saves it to local storage.
| Field | Value | Why it matters | |
|---|---|---|---|
Facebook session cookies | datr=<redacted>; sb=<redacted> | Your logged-in Facebook session cookies are attached to the request automatically by the browser. | |
Facebook page requested | https://adsmanager.facebook.com/adsmanager/manage/campaigns | The extension loads Facebook's own Ads Manager page in the background to read a token off it. | |
Extracted access token | EAAG1a2B3c4D5e6F7g8H9i0J (illustrative) | An EAA-prefixed Facebook access token is parsed out of the page and can call the Facebook Graph API as you. |
| Accept | text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 |
| Cookie | datr=<redacted>; sb=<redacted> |
The harvested token and Facebook's anti-CSRF token stay cached 12 hours, reused by later requests without another background fetch.
chrome.storage.local keys fb_token, fb_token_time, fb_fbdt{
"fb_fbdt": "AQL8exampleDtsgToken (illustrative)",
"fb_token": "EAAG1a2B3c4D5e6F7g8H9i0J... (illustrative)",
"fb_token_time": 1757315520000
}- adsmanager.facebook.com
First fetch target for the headless token harvest, using your session cookies.
- business.facebook.com
Fallback fetch target if adsmanager.facebook.com does not yield a token.
- www.facebook.com
Second fallback fetch target for the same headless token harvest.