So I'm trying to obtain a list of posts from a Facebook page that I have created. After reading the documentation, I need to provide a user access token / page token to each API request in order to get the data. The documentation states that the user access tokens & page access tokens come in two variants:
Short life, expires within a few hours / days.
Long life, expires within 90 days.
The application I am building is a aggregated news (Facebook, twitter and Instagram) feed that will be displayed to users on my website.
From what I have read, the app tokens don't have an expiration but cannot access the pages API.
Do Facebook really expect application owners to remember to manually update their keys every 90 days in order to keep the applications working, or am I missing something that I can do to automate this?
If it is only about your Page, you are not missing anything, and there is no way to automate generating tokens - that would make expiration dates pointless. You can only send yourself a reminder before it expires. But: It can also expire if your change your Facebook Password, for example. It would be a good idea to implement a proper error handling so you get a message when the Token does not work anymore.
If it is about other Pages too, you can apply for Page Public Content Access and use an App Token that is valid forever.
I am an admin of a Facebook page where I could post automatically an URL and a message every morning via a Python script for several months.
So far I used Facebook Graph API via a daily-ran Python script for this purpose with a never-expiring Page Access Token having manage_pages and publish_pages permissions. To obtain such an access token I followed a description similar to this. According to its steps I had to create an app on https://developers.facebook.com/apps. Finally I succeeded.
My Python code (including the never-expiring page access token) to post automatically on my Facebook page looked similar to this:
import urllib.request, urllib.parse
def fb_auto_post():
page_id = 'page_id_of_my_page'
page_access_token = 'never-expiring_page_access_token_of_my_page'
message = 'my_message' #(string) automatically generated by a previous function based on analyzing some daily data
link = 'my_link'
to_graph_API = 'https://graph.facebook.com/' + page_id + '/feed?message=' + urllib.parse.quote(message) + '&link=' + link + '&method=POST&access_token=' + page_access_token
urllib.request.urlopen(to_graph_API)
fb_auto_post()
This code worked fine for several months but now Facebook is performing an app review where my app failed and didn’t get approval for manage_pages and publish_pages permissions which both are required to continue posting automatically on my page. As a result I cannot use the above code anymore since my page access token has no permission to post to my page.
Now I am stuck and have two questions:
1:
I understand that Facebook will no longer let apps automatically post to their users’ timelines or pages and that's why my app did not get the required permissions. But is there an exception if the only page I want to post to automatically is my own? For example I found this quote in a manual:
"Your app might not need to request these permissions because people
posting are already set up with a role in your app's dashboard. If
this is the case you do not need to submit your app for review. See
the Roles tab in App Dashboard."
Since I am the admin of the app and also the admin of the only page I want to post to I think the quote fits to my case but I couldn't figure out how can I implement the exception described in it.
2:
The only reason I have created an app is to generate a long-lived page access token which I can insert into my Python code. Is there a way to bypass using a Facebook App? For example, is it possible to somehow automatically generate a short-lived page access token every morning via the Graph API? (As I’ve experienced, short-lived page access tokens still have the mage_pages and publish_pages permissions.)
Sorry for the very long problem description and thank you for your answers!
You can create a second application, not auditing, temporary use, waiting for the first application to be successfully audited, switching to a new permanent access_token
I am trying to programatically grab a few insights metrics from facebook for various pages (about 50 clients). Therefore I want to automate this.
I created a facebook app and have my app_id and app_secret. I also created a app_access_token which doesn't expire?
My question is this: How do I get the page access token for each of the pages I want to get insights from? Currently I...
STEP 1) ...went to the Query Explorer and seleted my app and grabbed a user_access token with the manage_pages and read_insights permissions.
STEP 2) I then used that user_access_token to go to https://graph.facebook.com/v2.5/{pagename}?fields=access_token&access_token={user_access_token} to get what I presume is the page_access_token.
STEP 3) I then use this token to do my queries for things like https://graph.facebook.com/v2.5/{pagename}/insights/page_impressions?access_token={page_access_token}.
Now since the app is already OKAYed, shouldn't be there a way to grab that user_access_token in step 1 programatically? They all expire except the app_access_token I described above. Can I use that token somehow in step 1?
I am not using and SDKs just pure https calls.
Actually it is possible. I managed to get an extended page access token by doing this:
https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id=[app-id]&client_secret=[app-secret]&fb_exchange_token=[short-lived-token]
from here. Basically you get a short lived user token and then use that to get a page access token and then use that with your app id/secret to get an extended page token that never expires (perfect for embedding in an automated reporting app).
It is convoluted but it works. And as a bonus if you register the APP on Facebook business manager, that page token will work on all sites you have access to under that business manager account.
I'm aware that there are many questions about Facebook access-tokens and the grief they cause, but despite much experimentation and reading many frustratingly vague blog articles (FB and otherwise), I'm still struggling to get a clear answer to my needs. Let me succinctly break down my process so far:
I am creating a site that, server-side, needs to pull the posts/statuses from a single Facebook Page
I am an admin of that Facebook Page
I have created a Facebook App
Using the Facebook Graph API Explorer, I've generated a short-lived key, connected to my app and my account, that grants permission to my account to view the access-tokens for my pages
I've converted my short-lived key to a long-lived key (60 days) ala scenario 4 from this
And here's where I am stuck. My 60 day key works fine for my server to pull the info needed from the page, but as far I can tell, there's no way to programmatically extend that 60 day key. I also do not know of a way to generate a new short-lived key without manually going to the Facebook Graph API Explorer and creating one.
Since it is my server making the requests to the Facebook API and not a user-based system (where I could easily request that a user authorize the Facebook app again), this creates a very clunky system. Since Facebook deprecated offline_access, is there really no permanent way to have my server pull info from my own page? Will I really have to create a new key by hand and manually update my server with it every 60 days?
Or is there something I'm missing?
Update:
The step-by-step guide that was previously found here has been migrated down into its own answer.
These are the steps that were previously in the question - they have been migrated to this answer.
Having found that it is possible to generate a Facebook Page Access Token that does not expire (with help from #Igy), here is a clear, step-by-step quide for all those looking to the same:
Make sure you are the admin of the FB page you wish to pull info from
Create a FB App (should be with the same user account that is the page admin)
Head over to the Facebook Graph API Explorer
On the top right, select the FB App you created from the "Application" drop down list
Click "Get Access Token"
Make sure you add the manage_pages permission
Convert this short-lived access token into a long-lived one by making this Graph API call:
https://graph.facebook.com/oauth/access_token?client_id=<your FB App ID >&client_secret=<your FB App secret>&grant_type=fb_exchange_token&fb_exchange_token=<your short-lived access token>
Grab the new long-lived access token returned back
Make a Graph API call to see your accounts using the new long-lived access token: https://graph.facebook.com/me/accounts?access_token=<your long-lived access token>
Grab the access_token for the page you'll be pulling info from
Lint the token to see that it is set to Expires: Never!
That should do it. You should now have a Facebook Page Access Token that doesn't expire, unless:
You change your Facebook account password
You lose admin access for the target page
You delete or de-authorize your Facebook App
Any of these will cause the access token to become invalid.
If you are getting (#100) Tried accessing nonexisting field (accounts) on node type (Page), go to the Access Token Debugger, copy the value of User ID, and use it to replace the "me" part of the URL in step 9.
This is covered in the Offline Access deprecation document
Use the 60-day token for the page admin to retrieve a Page Access Token (via /PAGE_ID?fields=access_token or /me/accounts) - the Page access token will not have an expiry time
An approach that works in 2019
I was recently trying to achieve something similar (to the use case described in this thread), but I wanted to make sure to respect Facebook's current policies, so I did a little research and here I'm sharing what I found.
My use case
So, as I said already, my use case is very similar to the one described here; that is:
I'm doing some work for a school district.
They are using a software tool to manage pretty much everything that relates to school transportation.
That tool allows them to send email notifications (to subscribers) when they publish bus delay alerts and school closure alerts.
A lot of people in the community follow the organization on their Facebook page, and that's the only place they look for those alerts.
So an employee of the organization has to manually publish each notification on the Facebook page (in addition to creating it in the transportation software). Moreover, those notifications eventually expire (or are simply deleted before they expire), so the employee has to go back later on to delete them manually as well.
It's a waist of time, so what we are trying to do here is to develop as simple system that periodically polls the software tool's database for new (and expired) notifications and update them (i.e. add and remove) on the Facebook page.
This is, in my view, a legitimate use case, but I wasn't sure how to implement it in a way that's in line with Facebook's policies.
The accepted answer
I followed the steps of the accepted answer and it worked, except that things appear to have changed: now, even though the generated page token does not expire, access to data does expire after around 60 days. You will see that as well if you follow the procedure and inspect the page token in the FB Token Debugger Tool.
Besides, the fact that the generated page tokens are tied to the user account is also unfortunate, because if the user updates his/her password, then the page token also gets invalidated.
How to do it in 2019
After several hours of research, I stumbled upon the following Facebook documentation article: Business Login for Direct Businesses.
It turns out that it is now possible, following the steps described in the above article, to generate a page token that is not associated to any particular Facebook user account and which will not expire (unless the FB App gets deleted or the underlying application token gets deleted, you know...)
So here are the steps and the most important parts:
You need a Business Manager account.
Verification will be required and a digital contract will have to be signed.
You need to add the target Facebook page to that account.
You need to create a Facebook App, and transfer that app to the same Business Manager account as well.
The app will have to go through Facebook's review process, because the following permissions will be needed: manage_pages and publish_pages.
Important note For the posts made using the generate page token to be visible to users other than the application administrators, that app will need to have been published and approved.
You may still experiment with the concept without submitting for review, but the posts won't be publicly visible.
In the Business Manager account (only after your app and page have been added to the account), you need to create what's called a System User, and give that user admin role (or permissions) to the target Facebook page.
A system user is owned by the Business Manager account, and isn't tied to a specific user. My current understanding is that one major use case for a system user is programmatic access to Facebook's Graph API (just what we need).
Then, for that system user, you need to generate a access token (which will be never-expiring). You will be prompted to select for which app. You will then select your target app.
You will then need to use the generated app token to generate a page token, which will also be never-expiring. The procedure is described in this article as:
GET /<PAGE_ID>?fields=access_token&access_token=<SYSTEM_USER_ACCESS_TOKEN>
That's it.
That token will never expire, and it won't be tied to a particular Facebook user, so it's exactly what we need!
The last part is to make sure that your Facebook app gets approved by Facebook. It's in fact the most important part, because the whole procedure is worthless if people don't see our posts.
I wanted to know for sure that I could rely on the above procedure to build something for my client without Facebook rejecting it in the end, so, beforehand (i.e. before starting to work on my client's project), I went through the whole process of creating a page, an app, a Business Manager account, etc. I verified my business. I submitted my app for review. In my request, I was very specific about my use case and emphasized that the app was for "self-use" (i.e. that the organization is developing an app for itself, not for other Facebook users). I got approved without less than 24 hours.
A few other notes about the app review process:
I had to select a platform for the app, so I selected website.
I had to indicate why the app needed the two permissions and how it was going to use them.
I had to indicate why the reviewer would not be able to sign into my app and try it (i.e. because the app will be used by a worker process).
For the mandatory screencasts, I simply presented manual operations in the terminal using the curl utility (to generate the page token and make posts to the Facebook page). I also showed how I was using Business Manager to link the system user to the page and generate a token, and so on.
Again, I was very specific about my use case, and I think that that helped.
I hope this information will be useful to people with similar use cases.
Many thanks to #redhotvengeance for step-by-step guide.
After some time, now there is clearly described in Facebook documentation:
https://developers.facebook.com/docs/facebook-login/access-tokens/expiration-and-extension
Extending Page Access Tokens
Apps can retrieve a page access token from Page admin users when they
authenticate with the manage_pages permission. If the user access
token used to retrieve this page access token is short-lived, the page
access token will also be short-lived.
To get a longer-lived page access token, exchange the User access
token for a long-lived one, as above, and then request the Page access
token. The resulting page access token will not have any expiry time.
You can also copy and past from the app dashboard on facebook.
The steps:
Go to https://developers.facebook.com
Select your app in the top right corner of the page
(pic of what it looks like)
Click on Messenger from the options on the left (it will go to setting automatically) (pic of what it looks like)
Go to the "Token Generation" section in the page. Select what page you want to generate the token for. (pic of what that section looks like)
The copy and past your page token where ever you need it.
Keep in mind that while in theory your token won't expire, that it is directly tied to what ever facebook account your logged into. So say you change your password or you remove the permissions from between your account and your app then your token won't be valid any more.
I am developing a backoffice server application wich is supposed to email our customers with ads campaign statitistics, where camapaigns are bundled from various providers, one of them being Facebook.
Now the problem is how to download specific ads campaigns from Facebook. Basically what I need is a table for specific campaign with values for impressions and clicks for each day from requested range.
One problem is that the application is background server process, running periodically without user interactions, so I suspect there could be a problem with authentication.
From what I have read so far, I believe I am supposed to
register my application on facebook
apply for Ads API access (?)
use either legacy REST API to get statistics, or perhaps adsstatistics from graph api (but I believe that the format there is not divided for particular days).
How am I supposed to authenticate in this case?
Any suggestion as to what is the right solution here?
(Note: In the past, I was doing similiar for Google, where I have successfully used http://code.google.com/intl/cs/apis/adwords/docs/guides/reporting.html - this is just for reference about what I need to achieve).
See this page for authentication once you have Ads API access:
http://developers.facebook.com/docs/authentication/
In the end you'll need an access_token which is specific to your application and the Facebook account you are accessing.
Here's our process:
Log into Facebook account that contains the ads data
Paste this into that browser's address bar:
https://www.facebook.com/dialog/oauth?client_id={your_application_id}&scope=ads_management,offline_access,read_insights&redirect_uri={your
website}
You should be taken to a page that allows you to
authorize your application for that Facebook account (green
Allow button)
Copy the authorization code that appears after code= in the redirected url
Paste this into that browser's address bar (you may not have a client_secret with your application, if you don't try this without the client_secret):
https://graph.facebook.com/oauth/access_token?client_id={your_application_id}&redirect_uri={your website}&client_secret={your application secret}&code={code you got
from step 4}
You should be taken to a page containing the access_token
I do not think you need to store the Authorization code since the access_token shouldn't expire (if you requested offline_access) unless the log in info is changed for the Facebook Account.
Stats Retrieval
For stats retrieval, I would not use legacy REST API since Facebook will depreciate it. Graph API does allow stats retrieval by day, use:
GET https://graph.facebook.com/stats/{starttime}/{endtime}/stats?ids={campaign_id}&access_token=...
starttime and endtime can be in YYYY-MM-DD HH:MM:SS format or as a unix (epoch?) time