Connect Facebook Messenger — Mediator

Connect Facebook Messenger

Facebook's OAuth does not grant apps access to personal DMs. To connect Messenger, paste your browser's Facebook session cookies once — the app stores them encrypted and uses them like a WhatsApp Web pairing.

Quick steps

After pasting, a background listener will start and your contacts' messages will appear in the Contacts page.

Why this method? What are the cookies? Facebook's public API doesn't let third-party apps read personal DMs — that permission has been removed since 2015. The workaround Mediator uses is the same one every unofficial Messenger client uses: reuse your existing browser session by copying cookies. You stay logged into Facebook in your own browser. Your password never touches Mediator. The cookies are stored encrypted and refreshed automatically, so this is a one-time paste unless you log out. **What you're copying:** The `Cookie` header contains all cookies your browser sends to Facebook. The minimum required is `c_user` (your user id) and `xs` (session token). Everything else improves reliability. **Why Network tab?** Facebook marks important cookies as `HttpOnly` — JavaScript can't read them. Only DevTools can. The Network tab captures every cookie in one shot, including `HttpOnly` ones like `xs`. Works identically in all browsers.
What happens after you paste? - The app parses your input (accepts `Cookie:` header value, DevTools table, or JSON) - A background listener connects to Facebook Messenger's MQTT endpoint - Incoming messages appear in your **Contacts** page - Connection stays alive as long as your Facebook session is valid
Known limitations - **End-to-end-encrypted 1:1 chats** aren't accessible (Facebook rolled out E2EE in 2023). Only group chats, page messages, and non-E2EE 1:1 threads work. If you need E2EE mediation, use WhatsApp instead. - **Session invalidation:** If Facebook logs you out everywhere, you'll need to re-paste cookies.
Security Cookies are encrypted at rest with a per-instance `ENCRYPTION_KEY` and never leave your server. However, **anyone who obtains these cookies gets full access to your Facebook account** for the session's lifetime — treat them like your password. Don't paste into a shared instance.

Safari

  1. Enable dev menu: Safari → Settings → Advanced → "Show features for web developers".
  2. Open https://www.facebook.com and log in.
  3. Cmd+Opt+I → Network.
  4. Reload. Click first facebook.com document request.
  5. Right sidebar → Headers → Request Headers → Cookie: line.
  6. Select entire value → Cmd+C.
  7. Paste here.

Downloads