How to Post Content on a User’s Facebook Timeline in 2026

No third-party app can post content on a user’s Facebook timeline on that person’s behalf. The publish_actions permission that once allowed it was deprecated on April 24, 2018 and switched off for every remaining app on August 1, 2018. Publishing to a personal profile now always requires the human to tap the button themselves.

This article exists because the search phrase is a leftover from a different era of the Facebook Platform. Between roughly 2011 and 2018, an app could ask for one permission and then quietly publish status updates, links and photos to a signed-in user’s wall. Whole product categories were built on it: auto-share plugins, “listening to” scrobblers, contest apps, social readers. All of that code is dead, and no amount of App Review will bring it back. If you found your way here from a Stack Overflow answer written in 2016, read the timeline below first and then skip to the options table.

What changed, and when

The shutdown was not gradual. Facebook announced it in the middle of the Cambridge Analytica fallout, gave existing apps roughly 14 weeks, and then cut the permission off. Meta has never reinstated a profile-publishing permission in any form, and later rounds of deprecation removed the two closest workarounds people migrated to.

What you can actually publish today

Plenty of the old use cases still have a legitimate path, just not through a personal profile. Pick the row that matches what you are trying to do.

Posting to a Page with the Graph API

This is the only fully automated Facebook publishing path left, and it is well documented. You need a Page access token belonging to someone who can perform the CREATE_CONTENT task on that Page, and three approved permissions: pages_manage_posts, pages_read_engagement and pages_show_list. At least one of message or link must be supplied.

# Publish to a Page you manage (works today)
curl -X POST "https://graph.facebook.com/v25.0/{page-id}/feed" -d "message=New build notes are up." -d "link=https://example.com/changelog" -d "access_token=PAGE_ACCESS_TOKEN"

# Schedule instead of publishing now (Unix timestamp, 10 min to 6 months out)
curl -X POST "https://graph.facebook.com/v25.0/{page-id}/feed" -d "message=Goes live Friday." -d "published=false" -d "scheduled_publish_time=1785600000" -d "access_token=PAGE_ACCESS_TOKEN"

# This is the call everyone is still searching for. It has not worked since 2018:
# curl -X POST "https://graph.facebook.com/me/feed" -d "message=hi" -d "access_token=USER_TOKEN"
# => (#200) Requires either publish_to_groups permission ... or extended permissions

Instagram, the Share dialog and everything else

The Instagram Content Publishing API is the closest thing to the old auto-poster, and it is genuinely useful: single images, videos, reels, stories and carousels of up to 10 items, published on a schedule from your own server. It only works on Instagram professional accounts (business or creator), media has to be reachable at a public URL when you publish, and filters are not supported. Permissions differ by login type, either instagram_business_content_publish with Instagram Login or instagram_content_publish plus pages_read_engagement with Facebook Login for Business.

For anything aimed at a personal profile, the honest design is a share button. The Share dialog takes your app_id and an href, opens a prefilled composer, and lets the person edit and publish. The Send dialog does the same thing for a Messenger message to a chosen friend. Neither needs a user token, which is exactly why they survived. On mobile, a deep link into the installed Facebook app achieves the same handoff. In all three cases you are trading automation for a click, and there is no way around that trade.

Schedulers follow the same rule. Buffer states it directly: “Due to API limitations, we are not able to connect to Facebook profiles at this time.” Hootsuite and Meta Business Suite are the same story. Business Suite schedules Page and Instagram content, not profile content. Buffer’s Group support is now notification publishing, where you get a phone alert and paste the post in by hand, because of the April 2024 Groups API change. If your marketing plan assumed profile scheduling, rebuild it around a Page. That also gives you real reporting, which pairs well with using Google Analytics for marketing and with tracking custom events in Google Analytics so you can see what the social traffic actually did on your site.

How a person posts on someone else’s timeline

Humans can still do what apps cannot, assuming the profile owner allows it. Facebook calls the target a profile now rather than a timeline, but the box is in the same place.

Desktop web

1. Open the person’s profile on facebook.com.
2. Scroll past the cover photo and intro card to the posts column.
3. Click the Write something to… box.
4. Type the post, attach a photo or tag people if you want, then click Post.

iOS and Android app

1. Search the person’s name and open their profile.
2. Scroll down past their photos and details to the composer row.
3. Tap Write something…, compose the post, then tap Post.

When the box is missing

If there is no composer on their profile, the setting is theirs, not yours, and no app or trick changes it. They have restricted who can post to their profile. The control lives at Settings & privacy → Settings → Audience and visibility → Profile and tagging → Who can post on your profile, where the choices are Friends or Only me. Only the profile owner can change it. A neighbouring setting, Who can see what others post on your profile, controls whether your post is visible to anyone else once it lands. Both are worth knowing about if you are auditing your own account, alongside the friends-list control covered in how to hide your friends list on Facebook.

Troubleshooting the errors you will actually hit

“(#200) Requires either publish_to_groups permission…” This is the modern response to an old me/feed or group-feed write. It reads like a fixable permission problem and is not one. publish_to_groups went away with the Groups API, and there is no profile equivalent to request. Delete the call and add a Share dialog or a Page target instead.

“Invalid Scopes: publish_actions” during login. Your login request still includes the dead scope. Strip it from the scope parameter. Leaving it in can make the whole permission request fail, so users may be silently unable to log in at all.

Page access token versus user access token. The single most common mistake. A user token gets you the list of Pages the person manages via /me/accounts; each entry contains that Page’s own token. Posting with the user token to /{page-id}/feed returns a permissions error even when every permission is approved.

App Review rejections. The usual causes are a screencast that starts after login, test credentials that do not work, a privacy policy URL that 404s, or a use case description that says “post to timeline” and gets read as a request for profile publishing. Describe the Page workflow, not the user workflow.

Tokens expiring. Short-lived user tokens last about an hour. Exchange for a long-lived one (roughly 60 days), then read the Page tokens from /me/accounts using it. Page tokens derived from a long-lived user token generally do not expire, but they die the moment the user changes their password, revokes the app, or loses their Page role. Store a refresh path and surface a clear reconnect prompt rather than retrying forever.

Frequently asked questions

Can an app still post to a Facebook user’s timeline in 2026?

No. There is no Graph API endpoint or permission that publishes to a personal Facebook profile. Meta’s own documentation for the user feed endpoint states you cannot perform create operations on it. The only automated Facebook publishing target is a Page you have been granted access to manage.

What replaced the publish_actions permission?

Nothing replaced it for profiles. Facebook pointed developers to its Share dialogs, which prefill a post but require the user to publish. For automation, the successors are the Pages API (/{page-id}/feed) and the Instagram Content Publishing API, both of which target business assets rather than people.

Why can’t I post on my friend’s Facebook profile?

They have set “Who can post on your profile” to Only me, under Settings and privacy, Settings, Audience and visibility, Profile and tagging. That hides the composer box from everyone including friends. Only they can change it. Send a message or comment on one of their posts instead.

Can Buffer or Hootsuite schedule posts to my personal Facebook profile?

No. Buffer says outright that API limitations prevent it from connecting to Facebook profiles, and every other scheduler is in the same position. They support Pages and Instagram professional accounts. Since April 2024 even Group posting is manual, delivered as a phone reminder to paste the content yourself.

Is there a legal way to automate a personal Facebook profile?

Not one that Meta permits. Browser automation and unofficial libraries that drive a logged-in session breach the Platform Terms and routinely trigger account checkpoints or permanent disablement. If a service advertises profile auto-posting, assume it works this way and that your account carries the risk.

Does the Share dialog need a Facebook login?

The plain web dialog at facebook.com/dialog/share needs only your app ID, and the person will be prompted to log into Facebook if they are not already. You only get a response callback if the user is logged into your app with Facebook Login. No publishing permission is involved either way.

Wrapping up

If you came here to fix old code, the fix is architectural rather than a config change. Point the publishing at a Page, move personal-profile sharing to a Share dialog, and if the underlying goal was reach on Instagram, use the Content Publishing API properly with a professional account. That covers essentially every legitimate version of the original use case.

If you came here as a Facebook user, the short version is that the “Write something” box on someone’s profile is the whole feature, and its absence means they turned it off. While you are in Settings, it is worth spending ten minutes on the rest of your privacy controls and on turning off the Facebook notifications you don’t want, which is the other setting almost nobody configures until it becomes unbearable.