Get Access

ThreatExchange is hosted on Meta's Developer Platform and requires a verified Business Portfolio, and one final ThreatExchange-specific review.

This page will walk you through each step in detail, though Business Portfolio and the Developer Platform may change over time, and so the most up-to-date help can be found on help pages specific to those tools.

Overview

To get access to ThreatExchange you will need to complete the following steps:

1. Create a Facebook account if you do not already have one.
2. Find your company's existing Business Portfolio, or create a new portfolio if your company doesn't have one.
3. Create a ThreatExchange Application connected to your business and adding the ThreatExchange "product".
4. Go through business verification if your portfolio is not already verified.
5. Add detail to your ThreatExchange Application and submit your usecase for review.

Facebook Account

Create a Facebook account if you don’t have one

See also: Create a Facebook Account

You will need a Facebook account in order to be added to a Business Portfolio. This account is only used to verify that you are a real person and use the developer platform. Your personal details are kept separate from the business details, and information from your personal account will not be displayed on ThreatExchange. If you have a personal Facebook account, you should use it rather than create a new one in order to prevent the new account from being flagged as inauthentic.

Log in with an existing Facebook account or create a new account by visiting Join Facebook.

Register your Facebook account on Meta for Developers

See also: Register as a Meta Developer

1. While logged into Facebook, visit Meta for Developers.
2. Click Continue.

3. Enter your phone number and click send. You’ll then receive a verification code needed to confirm your account.
4. Select the role that most closely matches your experience and click Complete Registration.

Meta Business Portfolio

In addition to registering all ThreatExchange users on Meta for Developers, your company will need a Meta Business Portfolio.

Determine if your company has a Business Portfolio

Before setting up a new account, check internally to see if your company has a previously established account. Your company may have an existing Business Portolio if:

1. Your company is part of another exchange program that uses ThreatExchange.
2. Your company advertises on Meta properties (e.g. Facebook, Instagram, etc.). Ask internally about who manages this account (often marketing departments) to gain access and add users to ThreatExchange.

If you think it is likely that your company has a business portfolio but aren’t aren’t able to find it, reach out to threatexchange@meta.com for help.

Getting added to your company’s existing business portfolio

See the Business portfolio article for how to invite people to your business.

Note that they must have them complete becoming a developer and then you'll be able to assign them as an admin or developer of the existing app, covered in assign a business asset

Create a New Business Portfolio

If your company does not have an existing Business Portfolio (see section above), then you will need to create an account and complete Business Verification. Note: If you just created a new Facebook account, you may be promped to wait a few hours before you can create a business portfolio.

While logged into your Developer account, go to the https://business.facebook.com/ and click Create an account.

Fill in the name of your company, your name, and a business email where you can receive a verification email. Click Submit to finish creating your business portfolio.

Note: If your company already has a Meta Business Manager account, you’ll see the following alert based on the email domain.

If you see this message, go to Determine if you already have a business portfolio above.

Create ThreatExchange App

ThreatExchange is built on Meta’s developer platform (see Meta Apps).

Determine if you already have a ThreatExchange App

You can see whether your Business already has a ThreatExchange app by navigating to https://business.facebook.com/settings/apps and looking for any with “ThreatExchange” in the name. If your company already has one, have one of your company's admins add you to the business portfolio under Add people to a business portfolio and assign a business asset.

Creating a New App

1. While logged into your developer account, navigate to the App Dashboard at https://developers.facebook.com/apps/ and click Create App.
   
2. App details stage: Add an app name such as “Company ThreatExchange” and confirm an email address with your company's domain is listed as the contact email for this app. Make sure also to link your company's business portfolio. Click Next.
   
3. Use-cases stage: When asked to add a usecase, choose "Join ThreatExchange" and click Next. You might have to select "All" use cases and scroll down to find the "Join ThreatExchange" usecase
   
   
4. Business stage: Select the business (must be verified) and click Next (ThreatExchange only works with Business even if other categories apply) and click next.
   
5. Requirements stage: Click Next.
   
6. Overview stage: Click on "Go to dashboard".
   

Business Verification

Business Verification is a crucial step to ensure you are an authorized representative of your company and to confirm that your company is a legal business entity. Click here for more information about this requirement.

Determine if You Are Already Verified

You can visit https://business.facebook.com/settings/security to check if your business is already verified. If you are already verified, you can skip this step entirely!

If you see that instead that your business is "Ineligible for Verication", it means that either:

1. You haven't yet linked your ThreatExchange app from the last step to your business portfolio.
2. Your ThreatExchange app was created with a type other than "Business". You can check the type from the settings screen, and create a new app with type business if you accidentally selected the wrong one.

If you see instead that you are not verified, but eligible to submit, then proceed onward!

Submitting for Verification

Document Preparation

Business Verification requires official documents to confirm your company’s name, address, and phone number. Ensure you have at least 1-2 documents per section before completing the next steps.

• EIN Documentation
• Certificate of incorporation or formation
• Business License

Or others as defined by country here.

• Utility bill
• Bank statement
• Business License

Or others as defined by country here.

Troubleshooting Business Verification

Make sure all of the details within your documentation are consistent with each other as discrepancies increase the likelihood the registration will be rejected. For example, if using “Company, Inc” in one document and “Company, Corp” in another document, the registration is likely to be rejected.

Use documents listed here and, if necessary, review Meta’s troubleshooting guidelines.

Complete Business Verification

1. While logged in, click your icon to open your app.
2. On the left sidebar, expand "App settings" and click Basic.
3. Scroll to the middle of the page and click Start Verification.
4. Confirm your Business Manager account and click Start Verification, which will take you to the Business Settings Security Center to continue with verification.
5. Click Start Verification, and then click through to get started.
6. Select the country that your organization is based.
7. Add your organization details and click Next. We recommend adding a Tax ID (EIN) if possible. Note: Make sure the details you submit exactly match the details of your legal business entity. Also make sure your business’s website loads and is HTTPS compliant.
8. If no matching record is found, upload supporting documents, such as a business license or articles of incorporation, to confirm the details you entered. Choose a method for confirmation.
9. After inputting all information, your verification status will be updated to In Review. You’ll typically hear back via email, but you can also check your status from the same page you submitted at.

If your business is verified, you can move onto the next step. If your business is rejected, click here to troubleshoot why your business verification is rejected.

Eligibility Review

Go to the Dashboard, select "Customize the Apply to ThreatExchange use case".

You will be navigated to the Eligibility review page

Follow steps 1 to 4 as prompted, once done, click on 'Add to submission' for step 5

**IMPORTANT** After completing all steps, REFRESH the Eligibility Review page and scroll to the bottom. Click "Submit for review" button to get access to the tool. You’ll receive an email confirming your access within 1-2 weeks.

Fill Out App Settings (Step 3 of Eligibility review)

Basic Information

1. While logged into your Facebook account, go to your list of applications.
2. On the left sidebar, expand the App Settings and click Basic.
   
3. Fill in the required information.
   • Upload a 1024x1024 app icon (a screenshot of your company logo will do)
   • Paste a link to your company’s privacy policy URL
   • Choose a category for your company (see category descriptions here)
   
4. Click Save changes at the bottom of the page.
   

Add a Platform

1. At the bottom of the page, click Add platform.
   
2. Select “Website” and fill in the appropriate information.
   
3. Click to Save changes.
   

Fill Out Your Use Case

Make the App Public

If you haven't already done so, check that you have changed the app's status to "Live".

Submit for Review

Once Review Is Complete

The name ThreatExchange appears with a green checkmark, and you see the subproducts "Descriptors", "Tags", and so on, in addition to "App Review", which you had seen up until now.

Do a power search for tag "testing"—you should see results.

Adding Users to Your ThreatExchange Account

Use the Access ThreatExchange UI tab on the Developer Dashboard to create accounts on threatexchange.meta.com. This is used for initial setup — where the first administrator invites themselves — and can be used for adding additional users to your organization afterward.

Sending an invitation

1. Navigate to your ThreatExchange application on the Developer Dashboard.

2. Under Use Cases, click Customize on the ThreatExchange use case.

3. Click the Access ThreatExchange UI tab.

4. Enter your email address or the email address of the person you want to invite and submit.

Accepting an invitation

The invitee will receive an email with a link to set up their account. They will need to complete the following steps:

1. Click the invitation link in their email.

2. Register an account using their email address and a password.

3. Login to ThreatExchange using the email address and password.

4. Set up two-factor authentication.

5. Accept the Terms and Conditions.

Once complete, you will have access to the ThreatExchange UI. After onboarding, we recommend disabling this invite flow and managing invitations exclusively from threatexchange.meta.com. You can do this from the Member tab in Settings.

Next, learn about Best Practices for Using ThreatExchange.