Instant Games

Zero Permissions Onboarding and Migration

Updated: Mar 25, 2026
Copy for LLM
This guide covers two paths: setting up Zero Permissions on a new app, and migrating an existing Instant Games app. Both paths end with your game running in the Zero Permissions environment with full access to overlay views and external networking.
If you are migrating from Canvas Games or Facebook Login for Gaming, see the dedicated migration guides instead:

New Apps

If you are building a new Instant Game from scratch, follow these three steps to enable Zero Permissions.

Step 1: Select Zero Permissions in Connection Settings

  1. Go to the App Dashboard and select your app.
  2. Navigate to Use Cases > Customize “Launch a game on Facebook” > Network Connection Settings > Connection Experience Settings.
    • If “Use Cases” is not visible in the sidebar, look for Network Connection Settings under Instant Games in the left sidebar.
  3. Select Zero Permissions and confirm your selection.

Step 2: Upload and Test Your Bundle

  1. Navigate to Use Cases > Customize “Launch a game on Facebook” > Web Hosting.
  2. Upload your Zero Permissions-compatible game bundle (a ZIP file with index.html at the root).
  3. Click Play to test your game in the Zero Permissions environment.
  4. Use the debugging tool if you need to troubleshoot overlay views or other issues.
Since your app is not yet launched, all sessions automatically load in the Zero Permissions environment.

Step 3: Request App Review

  1. Navigate to Use Cases > Customize “Launch a game on Facebook” > Permissions.
    • Alternatively, go to App Review > Permissions and Features in the left sidebar.
  2. Add Instant Games Zero Permissions Access to your App Review request.
  3. Complete the App Review process.
Once approved, you can publish and launch your game.

Existing Apps

If you have an already-launched Instant Game and want to migrate it to Zero Permissions, follow this process. It is designed to let you test and gradually roll out Zero Permissions without disrupting your live game.
Note: Selecting Zero Permissions as your Connection Experience setting will cause all Platform Test Users to default to the Zero Permissions model.

Step 1: Select Zero Permissions in Connection Settings

Access the same Network Connection Settings location described above for new apps and select Zero Permissions.

Step 2: Upload and Test Your Zero Permissions Bundle

  1. Go to Use Cases > Customize “Launch a game on Facebook” > Web Hosting.
  2. Upload your Zero Permissions-compatible bundle.
  3. Toggle Network Enabled Zero Permissions Settings at the top of the page.
  4. After the platform scans your bundle, click Play in NEZP to test.
  5. Use the debugging tool to verify overlay views and network behavior.
  6. When satisfied, mark your production-ready Zero Permissions bundle using the shield icon.
Important: No production traffic shifts to this bundle until you complete the final rollout step. Your existing players continue using your current production bundle.

Step 3: Confirm Data Deletion

Per Facebook Platform Terms, you cannot attempt to re-identify or de-anonymize users under Zero Permissions. You must delete any personally identifiable information your game previously obtained from Facebook.
  1. Go to Use Cases > Customize “Launch a game on Facebook” > Network Connection Settings > User Data Deletion.
  2. Delete the following data from your systems:
    • Player names
    • Player profile pictures
    • Friend names
    • Friend profile pictures
  3. Do not delete: Player IDs and gameplay data (scores, progress, purchases) may be retained.
  4. Check the confirmation checkbox to attest that deletion is complete.
  5. Save your changes.
You have a 14-day window after migration begins to complete the deletion. See the FAQ for additional context on data deletion requirements.

Step 4: Request App Review

Follow the same App Review process as new apps: navigate to Permissions, add Instant Games Zero Permissions Access, and complete the review.

Step 5: Roll Out to Production

  1. Go to Network Connection Settings > Zero Permissions Rollout.
  2. If the rollout percentage selector appears disabled, click the “i” icon next to it for instructions on enabling it.
  3. Select a rollout percentage to begin migrating production users to your Zero Permissions bundle.
  4. Monitor your game’s performance metrics at each stage.
  5. Increase the percentage incrementally until you reach 100%.
After migration is complete: Your workflow for publishing new bundles changes. In the Web Hosting page:
  • Tap the star icon to load bundles to the Zero Permissions environment.
  • Tap Play under Manage Hosted Assets to test bundles.

Messenger Calls

If your game supports Messenger Calls (co-play during video calls), you need to manage a separate bundle for the Messenger Calls environment.

Uploading a Zero Permissions Messenger Calls Bundle

  1. Go to the Web Hosting page.
  2. Verify that you already have a non-Zero Permissions Messenger Calls version. If you see a banner saying no separate Messenger Calls version exists:
    • Upload a copy of your current production version.
    • Push it to Messenger Calls using the video icon button.
    • Refresh the page.
  3. Upload your Zero Permissions-compatible Messenger Calls bundle.
  4. Push it to the Zero Permissions Messenger Calls environment using the shield + video icon button.
  5. Confirm that both versions (Zero Permissions and non-Zero Permissions) are visible.
Players eligible for Zero Permissions receive the Zero Permissions version; others receive the non-Zero Permissions version automatically.

Testing Messenger Calls

Platform Requirements

Zero Permissions for Messenger Calls is supported on:
  • Messenger Web
  • Messenger iOS version 517+
  • Messenger Android version 519+
Clients that do not meet these requirements automatically receive the non-Zero Permissions version.

Testing the Zero Permissions Version

  1. Toggle the NEZP environment on for your developer account.
  2. Start a Messenger Web call with another user.
  3. Find and launch your game from the game list.
  4. Verify the game loads in the Zero Permissions environment.
  5. Confirm via Chrome DevTools: Open the console and check that index.html is served from shield-apps-{your-app-id}. The shield prefix indicates the Zero Permissions environment.

Testing the Non-Zero Permissions Version

  1. Toggle the NEZP environment off for your developer account.
  2. Start a Messenger Web call and launch your game.
  3. Confirm via Chrome DevTools: Check that index.html is served from apps-{your-app-id} (no shield prefix).

Next Steps

  • Testing — Full guide to testing in the Facebook player and locally.
  • Debugging Tool — In-game debugging for overlay views and JavaScript.
  • Overlay View Components — Start building overlay views for your Zero Permissions game.
  • FAQ — Common questions about data deletion, permissions, and migration.