I am facing this error with some of my users, the case is as following:
I use facebook "App access token" to post actions to facebook Open Graph instead of the user access token because app access token don't expire according to facebook documentation unless you refreshed the app secret, I use the follwoing Post url to post actions
https://graph.facebook.com/user_facebook_id/App_Namespace:action_name?FBOG_Object=FBOG_OBJECT_URL&access_token=app_access_token
Some of the actions do appear on facebook, but for some users the actions fails to post and return the following message:
{ "error": { "message": "Error validating access token: Session has expired at unix time 1345759200. The current unix time is 1345925578.", "type": "OAuthException", "code": 190, "error_subcode": 463 } }
What am I doing wrong? Why do I have an expiration error although am using the app access token? Should I worry for user permissions?
After checking the servers it seems that the code that uses the app token was not deployed and the code that uses the user token is still there.
The app token does not expire unless the app owner took some action.
https://developers.facebook.com/docs/authentication/applications/
Error message clearly shows that your access token expired and you need to get another one.
However you can handle this issue : Access token expiration
Also if you are looking for a long life token you need to provide some more parameters while authorizing the application to a new user.
offline_access parameter can be included in a request but now it's been deprecated by facebook. Removal of offline access
Related
I'm trying to retrieve Facebook Lead using graph API using App Token to be long time token.
But the graph API return the following error
{
"error": {
"message": "A user access token is required to request this resource.",
"type": "OAuthException",
"code": 102,
"fbtrace_id": ""
}
}
I want to retrieve it with app token, any ideas.
Thanks in advance.
I have found solution. If you need to retrieve page leadgen then you must use page access token where ad was created and generated, otherwise it doesn't work.
How I have solved this case:
Connect to application and logging in with user
Exchange retrieved user short (1-2h) access token to long lived access token (~60 days if not using access token, else if you use it daily it will never expire)
call facebook api to retrieve user pages thru server using new users long lived token (this way page access tokens will have ~60 days and if use it daily then it will never expire)
when webhook sends you leadgen_id use server call to retrieve lead data using not app access token but long lived page access token that you have saved in database. As webhook sends leadgen_id, page_id and etc, you can connect page access token to page id and then with webhook data you can get correct access token and retrieve details about the lead from facebook.
For me this approach worked. I'm using Python to communicate in server side.
Comment or message me if you'r having issues.
We are facing issues with Graph API. The Facebook Graph API "/{page-id}/feed" is not working for all pages with a valid App Access Token. Previously it used to work. We noticed it today the API is throwing error
{
"error": {
"message": "An unknown error has occurred.",
"type": "OAuthException",
"code": 1
}
}
Not working pages:
https://graph.facebook.com/22934684677/feed?access_token=
https://graph.facebook.com/42798291365/feed?access_token=
Note: And its working if we pass a User Access token instead of App Token.
Facebook developer Docs says "An access token is required to view publicly shared posts." So App Access Token should work!
Does Facebook change something inside the API?. Can any one help to solve the issue
You should use a Page Token for Page data. Pages not working with an App Token are most likely restricted by age or location. Since the App Token does not include any user session, you can´t be sure if the user should have access to it.
If it does not work with an App Token AND the Page is definitely not restricted, file a bug.
This is happening because some of the posts returned might have extra restrictions on them which need a user token to verify this. Use a page token or a user token as a workaround for this. Having said that, the request shouldn't fail with an unknown error and we're working on a fix for the same on the bug report here:
https://developers.facebook.com/bugs/783169051760311/
Requested to renew an auth token about to expire. Got the new token back but app failed to save it due to bug. Now cannot request a new one because the old one is considered expired. What recourse is available?
Your only recourse here is to have the end-user disconnect their app, and then reconnect it.
Take a look at: https://developers.facebook.com/docs/facebook-login/access-tokens
Also,
Taken from: https://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/
The token expires after expires time (2 hours is the default).
The user changes her password which invalidates the access token.
The user de-authorizes your app.
The user logs out of Facebook.
Token expires after expires time
This scenario refers to the use case where a user has authorized your app in the past, but the access token that you were issued has expired.When you try to make Graph API call on her behalf you will get an HTTP 400 with the following error in the body:
{
error: {
type: "OAuthException",
message: "Session has expired at unix time
SOME_TIME. The current unix time is SOME_TIME.”
},
}
Scenario 2: User changes her password
This scenario refers to use case where a user has authorized your app in the past and then she changes the password associated with her Facebook account. In this scenario, when you try to make Graph API call on her behalf you will get an HTTP 400 with the following error in the body:
{
error: {
type: "OAuthException",
message: "The session has been invalidated because
the user has changed the password.",
},
}
Please note that you will receive this message even if your app was granted the offline_access permission if the user changed their password.
Scenario 3: User de-authorizes your app
This scenario refers to a use case where a user has authorized your app in the past, but then she de-authorizes your app by going to the App Dashboard. In this scenario when you try to make a Graph API call on her behalf you will get a HTTP 400 with the following error in the body:
{
error: {
type: "OAuthException",
message: "Error validating access token: USER_ID
has not authorized application APP_ID",
},
}
Please note that even if the user had authorized your app with the offline_access permission access tokens will become invalid if the user de-authorizes your app.
Scenario 4: User logs out of Facebook
This scenario refers to a use case where a user has authorized your app in the past and then she logs out of Facebook. If the user authorized your app with the offline_access permission then the Graph API call works as expected. If the user did not grant this permission and you try to make a Graph API call on behalf of the user, you will get an HTTP 400 with the following error in the body:
{
"error": {
"type":"OAuthException","message":"Error validating
access token: The session is invalid because the
user logged out."
}
}
I am using the Graph API for an app that chooses a "fan of the week" for Facebook pages and announces them automatically to their feed.
For the purpose of announcing the fan on the feed, I store the OAuth access token for the user who installed the app. However sometimes the tokens get invalidated and then the app will fail to post to the feed.
{
"error" : {
"message" : "Error validating access token: The session has been invalidated
because the user has changed the password.",
"type" : "OAuthException"
}
}
Here is another type of error I also get sometimes:
{
"error": {
"message": "Error validating access token: Session does not match
current stored session. This may be because the user changed the
password since the time the session was created or Facebook has changed
the session for security reasons.",
"type": "OAuthException"
}
}
I already have the "offline_access" for these users, but the tokens are still becoming invalid sometimes. Is there anything else I can do to prevent this from happening, besides sending the user an email asking them to visit the app page again so that I could get a new OAuth token?
There's no way around this that doesn't require user intervention of some kind. If it's an app or page users are unlikely to visit frequently, then sending that e-mail sounds like a good idea. When users visit the page or app you can use the FB Javascript SDK, which automatically refreshes sessions, and subscribe to the FB.Event.subscribe('auth.sessionChange') with a handler that updates the token in your database.
If you are trying to publish to a users feed and you have publish_stream permission which hasn't been revoked, you can mostly likely still publish to /userId/feed using an access_token in this format: appid|appsecret. Note that /me will obviously not work because you are using the applications access token.
if I use safari to authorize user with facebook everythig work, but if use native application i have error:
{
"error": {
"type": "OAuthException",
"message": "Error validating access token: Session has expired at unix time 1315843200. The current unix time is 1315919174."
}
}
if I tried log out and next log in, I got same access token. How may I resolve this problem?
If you get OAuthException you need simply to reauthorize.
Also when your app is started you need to make a call to graph API "me" and in case you get exception you need simply to re-authorize, then you proceed with regular workflow of API calls.
You can make your access_token not to expire by requesting offline_access extended permission, but it still might be invalidated.
hope this helps