I've been working on a website which use public facebook information such as posts.
There are few important things i'd like to emphasize :
User access token is definitely different from app access token
I'm not building a facebook app , but a site which uses facebook public information.
The problem comes up when I use a certain user access token , and about half an hour later I can not use this access token anymore becuase it has expired.
I'd like to know how am i able to get a permanent or at least a long term user access token ?
Thanks in advance
I don't think you can set when it expires. However the auth token should be extended whenever you need it and it has expired. The reason it's short is probably for security.
(I've only worked with the iOS SDK but I assume it follows the same principle)
Related
Should the limited login store the access token for future session?
I'm transferring my iOS app from classic login to limited login. But I can't get the auto-re-login to work.
Re-login with classic works correctly as docs says. "The FBSDKLoginManager sets this token for you and when it sets currentAccessToken it also automatically writes it to a keychain cache." The app r-logins correctly.
But with limited login it seems it doesn't store the token. Should is store? The docs are unclear whether limited login should do this or not.
Best, Hu
Let's start with some points to proceed:
Limited Login mode doesn't provide you an Access Token. It provides you an Authentication Token. It's a regular JWT you can parse, but you are not able to use it for FB Graph API requests;
You can get the basic information about the user just by decoding this Authentication Token or using FB SDK right after signing in;
Currently, this token has an expiration of 1 hour, but you don't really need to refresh it every hour unless you need to get an update of the user information (for instance, to fetch a changed name, email, or a list of friends);
As you can see in the official blog post of Facebook, to refresh a token with information inside it, you need to re-authenticate a user, so call an SDK method to show FB popup. Reference: FB: Announcing expanded functionality in Limited Login
Currently, the official documentation is really unclear and has just a couple of pages related to the Limited Login mode. So if you still have any other questions, feel free to ask, I'll update the post.
I am the administrator of a Facebook Page. I am building a web app which, under certain circumstances, will post on Facebook as that Page.
With most APIs, I would just get an API key, and supply that when connecting to the API from my app. But Facebook expects an access token instead of an API key. (Specifically, in this case, it needs a "page access token".)
I am trying to figure out how to get a page access token that will be as permanent as possible.
After jumping through a bunch of esoteric, undocumented hoops (see here and here) in order to get a token that wouldn't expire, I had this working. When I ran the token through Facebook's Access Token Debugger, the "Expires" field read "Never". All was good in the world.
But, the next day, my token became invalid anyway. The Access Token Debugger, and my app's calls to Facebook's PHP SDK, both started returning this error:
Error validating access token: Session does not match current stored session. This may be because the user changed the password since the time the session was created or Facebook has changed the session for security reasons.
It seems that a token can become invalid for a variety of reasons (but this article is five years old, so who knows – Facebook changes things every two weeks). I had not changed my password. (I might have logged out of Facebook, though.) Facebook offers no specifics about why this particular token might have become invalid.
I've also seen a few references to a permission called offline_access, but Facebook seems to have removed this.
I suppose my question is twofold:
In general, I've found Facebook token authentication to be incredibly brittle when calling the Facebook API from the server. The token system seems to be designed mainly to allow other users to grant (or revoke) various kinds of account access to my apps. But that's not what I'm doing – I'm trying to get a token that will let me post to a page that I own. And for that scenario, Facebook's aggressive invalidation of tokens becomes a serious liability. I can't launch my app if my access token (and therefore my Facebook integration) could randomly stop working at any moment, requiring me to generate a new token and update the app. This seems absurd. Is there an alternative method of authenticating to Facebook for my purposes?
If a page access token is, in fact, the best way to authenticate my app to Facebook in order to post as my Page: how can I ensure that my token doesn't spontaneously become invalid?
I hate developing for Facebook :/ Thanks for any insight you can offer.
Extended Page Tokens are valid forever. They only get invalidated if you change your password or if you change the App Secret of your App. There´s really no magic in it, checking if the Token is still valid is obviously not a bad idea but that´s up to you. For example, you can send yourself an automated Email when there is an error using the Token, so you can refresh it. But it will really just happen if you change your password.
Links:
https://developers.facebook.com/docs/facebook-login/access-tokens
http://www.devils-heaven.com/facebook-access-tokens/
I'm trying to better understand Facebook Access tokens. I have a canvas web app in a sandbox. I have used the GUI to say the app seeks permissions for various user fields. The user then sees these listed and clicks the blue Go To App button. (Currently only developers and testers).
My questions are around the Access tokens. I've used the Graph API explorer and the Access Token Tool. In the Access Token Tool - there are User and App tokens listed. What are these for?
A user must have a token to use an app - this token is generated when they click to use the app... can this expire? What is the purpose of an app access token? Is this to be used to view which users are subscribed to the app?
Any explanation or step through of the process of accepting and using an app on facebook would be greatly appreciated!
Thanks :)
Access token is similar to a password in a weaker notion.
Whenever a user tries to access to a resource, your app should authenticate the user. In this context, your app requets to access some or all user data, in return you are given an access token that expires in a short period of time. Something like 1 hour, then once the token expires you need to authenticate the user again. There are ways to extend expiration duration upto 2 months.
Facebook docs are pretty clear and concise about tokens, you can read through them, and depending on the language you are using, there are API's you can benefit from.
Overall pretty easy.
Using the above libraries, I can get the details of a user, his authorisation, his friends, but only once: I need to store the access_token and key in database, so the user can access his friends walls or other public details.
Can anyone help?
(I have used OAuth for Twitter and Tumblr, but I can't get it for FB).
https://developers.facebook.com/docs/authentication/
Be careful with saving the token. When not requesting all-time permission, it expires in a certain time (what might be your problem)
When using a canvas app (the ones integrated in apps.facebook.com) requesting another token is quite simple. Facebook posts a signed_request parameter to your app whenever a user accesses it (https://developers.facebook.com/docs/authentication/signed_request/).
Decode it, pass it to the Graph API, profit.
if you need a generic access_token without a login... you can use $appID ."|". $secKey
this is called a APP access token, so it would be logged in as the "Application" not a user
!!! make sure you use this on https://graph.facebook.com/ !!!
hints the "https://" for secure SSL connection
but the API already determines this.
I am the owner of a facebook like page. I want to grab the news feed using php and output it on my website. I know that I can do this using a valid access token:
https://graph.facebook.com/my_app_id_here/feed?access_token=My_access_token_here
Problem access tokens expire so I know I need to authenticate periodically to get a new access token.
This is where the problem and confusion arises for me. When I read the authentication guide in the facebook dev docs all it talks about is first authenticating the user to get a authorization code from the user and then authenticating the app using the app secret, app id and auth code fromthe user. But this doesn't apply to my situation - I never have a authorization code form the user - all I'm trying to do is access the feed from a php script running on my server....a user is never involved.
Any ideas anyone?
User has to approve your application only once, and later use they can just access your app and use it without approving
Since you are the owner of the like page, I guess you are also the administrator. What you can do in this case is create an offline access token for this (and only for that) user.
You can then use this access token for your script. No user needs to authenticate anything if you only want to grab the feed of your page with the access token of your administrator.
This token never expires except for changing the user's password or taking away permissions again. Look at this answer to see how to create such an offline access token!
It seems offline_access is no longer available. Now you only get a short-lived access_token and you can ask for a long lived one, which is also renewable. You can't get a permanent one though.