I've inherited a web app has Facebook oAuth integration with Facebook. It uses Facebook for login as well as making API calls to graph for other purposes.
The original developers set up multiple apps per environment instead of making one parent app and using child testing apps. However, I cannot fund the production app. That is, I have the app ID and the secret, but can't find the actual app. I made some API calls to get the user ID of the person who set it up but he does not respond to my requests.
What are my options? Can I somehow migrate production to a new app? The facebook IDs the app use are app-scoped, so what I'd like to do is make the production app the one app both development/staging etc. use.
Besides for needing control over the production app, if I switch to use a different app for production, each users' facebook ID will be different and thus each existing user will be seen as a new, distinct user even if the user has already registered.
I have more than few clients that would like to add facebook connect to their landing pages (managed by me). They are too many and not enough tech-savvy to manually create ad appid for each of them.
So my only solution is to usa my own appid to add facebook connect to all my clients websites, but as far as I know, Facebook doesn't allow to simply use the same appid on any domain.
How can I solve this? I can't find any documentation to solve my issue. Does anyone have a direction for me?
This has been discussed a couple o’ times before already – but I mostly commented on earlier questions, so let me write the whole thing up as a proper answer, for future reference.
[paraphrased] Multiple-client Facebook login via one single app id
Does anyone have a direction for me?
You probably rather don’t want to do that.
It is not really possible to run one simple app one multiple different domains.
As a workaround for only a few domains, people used to specify different domains for the different platforms – Website, Page Tab or Canvas App, plus Mobile alternative for Canvas – without actually using any of those platforms besides Website, which made the app usable on multiple domains as a website app. But since Facebook introduced their login/permission review process¹, you can’t do that any more – they expect you to present actual functionality on all platforms you have configured in your app.
You can kind-off use one single app for login on multiple domains – if you are willing to use only the server-side login flow, and to redirect users to one “main” domain (that gets specified as the app domain in the app settings) to login, and then from there back to the origin domain.
But this has several drawbacks:
It’s not what you’d call a “white label” solution. If your clients expect it to look as if users where logging in via “their” app, it should stay on their domain. Individual branding, in regard to stuff such as app name, app logo that shows in the login dialog, etc., would also not be possible. Additionally, app attribution – the link that shows up under content shared/posted via the app – would only link users back to the main domain, and not to your customer’s.
You would not be able to use the JS SDK for client-side API requests, or even just to embed it to render any of the FB social plugins that require an app id – the SDK checks what domain it is “running on”, and can not be tricked to accept a domain that is not specified in the app settings.
There could be privacy issues. An over-exaggerated example: Just because I as the app user decided to share my photos or videos I have on Facebook with your customer Our-Holy-Mother-of-Christ-Bakery.com, does not necessarily mean I want to share them with your other customer, amateurs-doing-all-kinds-of-nasty-stuff.xxx as well – but if they shared an app id for login purposes, I automatically would. Have fun writin’ the Privacy Policy (which is mandatory if you use FB login functionality, and FB also automatically checks if your app has got one) for that scenario ;-)
Finally, and most importantly: All your customers would be “sitting in the same boat.” If one of them, or in turn their website users, would publish spam via your app id, so that Facebook blocks it, login would not work any more for all of your customer’s websites. And if you decide only then, that setting up an individual app for each of your customers would be the better way to go, they would not be able to recognize their existing users any more, because of user ids being app-scoped since API v2.0 was introduced – so if users logged into this new app, that app would see a totally different user id. (And to rely on an email address as an identifier is risky, too, because you will not get one from the API for every user; for example if they registered using their mobile device.)
Edit: Plus, app/domain insights, as luschn mentioned in his answer.
¹ Yes, the review process has made it more laborious to set up multiple apps for multiple clients. But for apps that do the same stuff/use the same permissions in the same manner, you can refer to an earlier successfully reviewed app id to speed up the process a little. Also, screenshots of how f.e. posts made via the app look on timeline, and what UI components are used, as well as screencasts that you include in your submission could probably be used with little to no alteration.
Apps are not meant be used on several different domains, you will have to create a new App for each domain, i´m afraid. You can use the different platforms in the App settings to use different domains, but there are only a few so it´s pointless. Just create some screenshots and a tutorial for your clients, that´s how it is usually done.
Btw, it would be weird to authorize an App on a website, and the same App would allow you to be authorized on all other client websites. Also, insights are per App, so your clients may want to see their own insights and not the global insights of all domains together.
Many is not defined but i think for being a smart developer you need to create new app_ids for every project you need to use facebook connect. Just my opinion. It also allows you to monitor alot of stuff.
I am software tester working on outsourced projects for many clients.
Frequently, I am required to test Facebook apps just before they go live. Often, the content of the app requires several interactions with other Facebook friends, including pulling of tagged photos and retrieving a user's info.
Most advice suggests that I should be using Facebook test accounts, created by a developer of a specific app. However, due to the complexity of some of the requirements in order to fully test certain apps, a dummy account - pre-filled with 'real' information is much more practical to use. It is clear that if we were to add all of this detail to Facebook test accounts for every new project, we would never get any time to actually test the app.
My company has approximately 20-30 dummy user accounts on Facebook, all of which have a good level of detail including personal info, photos, friend networks etc. These are perfect for testing as they are normal Facebook accounts. We always set option to private to prevent any sensitive material from being seen by the general public.
Over the last moth or more, our dummy user accounts are being systematically wiped out where Facebook is blocking them. Clearly, we cannot re-instate these accounts as we have no ID for the 'dummy' users.
Our aim is to aid the developers to improve the quality of their Facebook apps, and so has no detrimental effect on Facebook as a company or a brand.
Is there any way to achieve our requirements without the constant battle to maintain our dummy accounts?
Login to facebook. Then use /whitehat in the URL. On the left hand side you will get an option to create test accounts.
Test users are the only way to do this without violating Facebook's terms of service.
You can use multiple apps with a Test User, assuming you're not deleting and recreating them between test runs
I freelance now and I am wanting to set up a Facebook account so I can create multiple apps for different clients under this account, then become admin and roll out the app totheir page.
Does anyone else do this and if so how best is it to set up from the outset as I will need to test without the public seeing etc.
Yes - I do this frequently...
Placing your application in sandbox_mode will ensure that only the people who are allowed to see the application have access to it.
You can also add your applications to your own un-published Facebook page, that way no one will be able to search for your page or application either.
A mixture of sandbox_mode and an un-published page should be the safe way to go. Check out the Application Security page in Facebook's documentation for exact explanations of sandbox_mode and the roles you can give users in your application.
I want to build a mobile application that allows end users to sign up and participate in events (like parties, seminars, conferences etc..). Instead of building a CMS from scratch for an administrator to manage events, is it possible to use Facebook Events as the CMS? Then my mobile application will pull information about these events via the Facebook API.
Any one know if it's better for me to build the CMS from scratch or to use FB events? And what are things I have to consider in making this decision?
Let's say events are authored by users of the system, and if we go the FB CMS method, then users MUST have a Facebook account.
This is certainly possible with the events Facebook api. If you wanted all the events associated with an account you own, you could embed an access token into your application. If you want people to accept your event or host the event under their own account you would need to prompt users for permissions to manage events on their behalf.
It's pretty subjective question whether this is a good idea and it depends on what you are trying to achieve. The biggest upside is that its already built for you and designed to scale and wouldn't require servers, etc. The biggest downside I see is that Facebook changes their API and its not always the most reliable (see the always growing bug list they keep). Also, users may need an account depending on how you decide to implement the functionality.