From sign-in to a connected channel

You start from your existing Homa CRM workspace. Your Homa account determines which tenant the new connection belongs to, so a connection made from one workspace is never visible to another.

• Only users with the right role in Homa CRM can start or change a connection.
• The tenant identity is decided by your Homa session, not by anything in the URL.
• If you land on the connection page directly, you will be asked to sign in to Homa CRM first.

The platform builds the authorization request on the server, attaches a single-use state value bound to your session, and redirects you to Meta. From that point you are on Meta’s domain.

• The requested permission set is limited to the features you are enabling.
• The state value is validated when you return, which mitigates cross-site request forgery.
• You can cancel on Meta’s screen at any time and nothing is connected.

On Meta’s consent screen you choose which Pages, Instagram professional accounts or WhatsApp Business assets to grant access to. Assets you do not select stay out of scope entirely.

• You must hold sufficient administrative access on any asset you authorize.
• Assets that do not meet Meta’s eligibility rules will not appear as selectable.
• You can return later and authorize additional assets without recreating the connection.

After Meta redirects you back, the platform validates the state value and exchanges the authorization code for a token from server-side code only. Connected assets then appear in Homa CRM.

• Review which assets are connected and which permission set was granted.
• Disconnect any asset, which stops further platform access to it.
• Reconnect when a token expires or a permission is withdrawn.
• Submit a data deletion request from the public website at any time.