I've been trying to solve this problem for a while now and I can't seem to get it to work.
I want my website's users to link their facebook account with my website. So they can see their stream e.t.c on my site.
All of this is working fine. But now I want to give the users an option of being able to disconnect their facebook account from my site.
In order to do this, all I do is delete the offline authentication key that I have with me. But the next time, the user tries to reconnect their facebook, I get an error which says "An error has occured"
The user has deleted permissions on my end but has not revoked access to my app on facebook. This is when the issue occurs. Is there a way for me to revoke access through the api?
You you delete the access token on your end then you need to get a new one through the API when they want to "reconnect".
Also be aware that the offline_access permission is going away:
https://developers.facebook.com/roadmap/offline-access-removal/
So this is something you're going to need to be doing in the future anyway.
I figured out that the solution to my problem was to send a DELETE request to /user_id/permissions with the access_token.
This deletes all permissions for the app.
Related
I have facebook messenger application (it is bot using MS Bot Framework, although I don't think it is relevant). It has webhook subscribed to page events. It used to work fine until few days ago, when the webhook was unsubscribed from page and when I am trying to subscribe again it tells me:
"Insufficient Permission You do not have the necessary permission for
the specified Page to perform the requested action."
I am owner and admin on both the FB page and messenger app. I created similar page and messenger app and it works there, but I still need to use this old one. I tried subscribing to other pages which I own and admin, but with same result. I also tried it with other person who is admin.
I found other people experiencing same/similar message on FB, but not in this particular case. But I haven't found any solution.
Does anyone know what could be the problem? Or have anyone experienced this issue?
Thanks in advance for any ideas.
You need to generate a token first. Under messager->Settings->Token Generation-> Select your page and you'll be prompted to give the permission. Grant all permission required, then you shall be able to subscribe or unsubscribe to pages you manage.
This process gives your application the token to validate if you have the moderator or higher rights to the page you want to subscribe to.
After spending 3 days on this. Here is the solution for this.
Go to your Facebook Profile - > Settings -> Apps
and Remove YOUR APP from there.
In Developer Dashboard Go to App Review -> Add Items
manage_pages
(This Permission Needed for Accessing page access tokens)
Add above permission for review - with any simple video of above error
Now go to Messanger-> Settings -> Token Generation
Select page from dropdown List
now it will open a popup (because you removed this app in 1st step) for app access permission , notice that now it will ask for manage pages permission
Grant those permission and create access tokens
Now try again subscribing Webhook to Pages
This Works for me.
You need to generate your page access token for this.
Go to your facebook Developer dashboard, and open the messenger tab. There, you will see this for token generation. Select your page and generate the token. Then use this token in your bot.
Page access token generation
I have users who have authorised my app and are using it. I now need to request further permissions on top of this and I remember reading that the Javascript SDK has some inbuilt methods which allow you to just request the permissions which have not already been handed over. I've looked around a fair bit but I can't find any information on this anymore.
Can someone confirm that this exists, and if possible, how I can do this? I actually switched from using the PHP SDK for the login just because I read about this feature!
You can actually do this in the php-sdk as well. What you need to do is inspect the permissions connection and see if the user has granted the required permission to your app
https://developers.facebook.com/docs/authentication/permissions/
If not you can either redirect them to the auth dialog, or prompt them with a button and explain why you want them to authenticate again.
You can view a sample response at
https://developers.facebook.com/tools/explorer/?method=GET&path=me%2Fpermissions
Alternatively,using the Auth Dialog
https://developers.facebook.com/docs/opengraph/authentication/
might also achieve what you are after, though this only works on referrals from Facebook I believe
It's the same procedure as with users who have disconfirmed a permission. In that case the documentation for invalid access tokens applies: https://developers.facebook.com/docs/authentication/access-token-expiration/
So, you just need to reauthenticate the user including the additional permissions in the scope parameter.
You should be able to check for granted permissions, then if they are not the same as the ones you need then just redirect them to log in with he extended permissions you require and that's it.
http://developers.facebook.com/docs/reference/fql/permissions/
As mentioned in this other question, if a user grants the publish_stream permission, I can publish to that user's wall using an app access_token. I tested that and it works. But I couldn't publish to the user's pages using the app access_token! Am I missing something?
Right now I use the /me/accounts/ connection to get the access_token of the pages, and use that to publish. But this is a huge headache for me and for users because these tokens expire often (when users change their password, ...et), and every time that happens the publish fails and I need to email the user to come login again so I can retrieve a new access_token for the page. It's a bad user experience and I'm trying to find a way around it. The app token works for publishing to users, which is great, but I couldn't find a way to make it work for pages. Any tips?
Edit:
To clarify further, I currently request the manage_pages and offline_access permissions, and then fetch the access_token of each page and use that to publish to it. That works. The main problem is that tokens expire, even with the offline_access permission. The most common reason a token would expire is if the user changes her password. Here is a common error that I get a lot when publishing to Facebook pages.
Facebook error. type: OAuthException, message: 'Error validating
access token: Session does not match current stored session. This may
be because the user changed the password since the time the session
was created or Facebook has changed the session for security reasons.'
To handle this, I email the user and ask them to visit our app again, and when they do I grab a fresh set of access_token to work with. But that's problematic because users are confused about why the error happened and blame us for it, and some users don't open their emails so the problem doesn't get solved and then they're angry later when they discover that our app had stopped weeks ago without them asking it to stop.
That's why I was hoping that I can publish with the app access_token to avoid these problems. Since it works for user profiles, I hoped it would work for pages as well. But so far no luck, unless I'm missing something obvious.
What you're describing used to work - all last year we were able to successfully post to fan page walls using the app access token. In fact, for some of our users, I see it still working. However, I think the other two answers are correct, this is no longer the way to post to pages (see "Page Login" here)
That said, you should be able to store the access token of the page to spare yourself the step of re-querying the users' linked accounts.
Unfortunately, the page's access token will suffer the same fragility as a user's, per the answer here: Facebook Page Access Tokens - Do these expire? . The page access token will expire when the user who gave you that access token changes their password.
To publish to pages, there is an extra step where you use their token to get a list of their pages. Each page has its own token, use that token to post to the page. Keep in mind that when setting up the original token, you need to specify that you need access to pages.
my app does exactly what you're after.
I request both manage_pages and offline_access permissions from a user.
I store the user's access_token.
I ask the user which page (determined by me/accounts) they want a stream item posted to and when.
Later, when it is time to publish to a page's feed, I grab the user's access_token from the database, the pageid, and the message.
Using that user's access token, I query the me/accounts and grab the latest access token for that account (aka page)
Using that page's access token, I me/feed (or is it me/posts...away from my codebase at the moment) post the stream item.
I am the owner of a facebook like page. I want to grab the news feed using php and output it on my website. I know that I can do this using a valid access token:
https://graph.facebook.com/my_app_id_here/feed?access_token=My_access_token_here
Problem access tokens expire so I know I need to authenticate periodically to get a new access token.
This is where the problem and confusion arises for me. When I read the authentication guide in the facebook dev docs all it talks about is first authenticating the user to get a authorization code from the user and then authenticating the app using the app secret, app id and auth code fromthe user. But this doesn't apply to my situation - I never have a authorization code form the user - all I'm trying to do is access the feed from a php script running on my server....a user is never involved.
Any ideas anyone?
User has to approve your application only once, and later use they can just access your app and use it without approving
Since you are the owner of the like page, I guess you are also the administrator. What you can do in this case is create an offline access token for this (and only for that) user.
You can then use this access token for your script. No user needs to authenticate anything if you only want to grab the feed of your page with the access token of your administrator.
This token never expires except for changing the user's password or taking away permissions again. Look at this answer to see how to create such an offline access token!
It seems offline_access is no longer available. Now you only get a short-lived access_token and you can ask for a long lived one, which is also renewable. You can't get a permanent one though.
I have recently started getting this error while posting to facebook newsfeed stream
of an app user,
I do have an offline access permission for the access tokens, and they worked
fine previously.
This error is coming for 30-40% of the users.
"Error validating access token: Session does not match current stored session.
This may be because the user changed the password since the time the session
was created or may be due to a system error."
It's possible for your access token to become invalid for a variety of reasons (expiry time passed, user changed password, user deauthorized your app, user logged out of Facebook, etc.). You should always design to account for this scenario.
If your users are active, it's easy to get a new access token from the OAuth endpoint without them having to do/see anything. If not, you should make a plan (such as emailing them) for how you will get them to return so you can get a new access token. The scenario you're describing is not necessarily unusual. You can find some code samples here for help on how to handle expired access tokens.
This is undocumented but I just tested it and it works with expired access tokens. Should work on access tokens that have been invalided if you know their user id, and they haven't revoked privileges to your app. First, you can verify that you still have have the permissions you need by calling using this url:
https://graph.facebook.com/userID/permissions?access_token=appID|appSecret
If you still have publish_stream permissions, you can issue a HTTP POST to this url:
https://graph.facebook.com/userID/feed
with post parameters of access_token=appID|appSecret&message=test message
There seem to be a lot of questions about why your token would have expired so quickly. I think I can shed some light on that. Here are a number of scenarios I have found which cause this:
There is the obvious one; the user changed his password. There is nothing you can do about this. They will need to reauthorize your app. The rest of these scenarios deal with page tokens, which are similar to a token for a user profile, except they come from querying /me/accounts with the user token of a valid administrator for the page. These seem to expire much more frequently.
It seems that if ANY administrator of a page changes their password (not necessarily the one who's token you are using), this can cause the token to expire. Also, if you have some pages in your system with the same administrator, calling /me/accounts often refreshes ALL of the tokens for the pages this user administrates. That means if you are connecting a new page for a user with existing pages, you will need to update the existing page tokens with the new ones provided by /me/accounts.
Finally, the way I deal with this in my system is to store the admin user and token as a parent of the page token in my database. This way when I need to reconnect a page or add a new page, the system can lookup and update any related page tokens received from /me/accounts. It also allows you to automatically attempt to refresh the token by calling /me/accounts when you receive the expired token exception.
Hope some of this helps!
Check out the blog post officially from facebook: How-To: Handle expired access tokens
The offline session token is changed whenever a user changes his password. If a previously working session suddenly stops (and you're getting that error) then the user's password was changed (probably by the user) and you will need to re-prompt them to grant you offline access and save the new session token you get.
I also faced this issue while accessing the post comments from my command utility. In my case everything was working fine, until suddenly I got the error:
The remote server returned an error: (400) Bad Request.
After diagnosing the problem, I found that the Facebook access token is expiring after a period of time even though I created it with the offline_access option as below:
https://www.facebook.com/dialog/oauth?client_id=[APPID]&redirect_uri=[URL]&scope=user_photos,email,user_birthday,user_online_presence,offline_access
After wasting of lots of time on RND, I found that there is an option in the app's Advanced Settings for Remove offline_access permission. My client had enabled it, and that's the reason my token was expiring. Have look at the image below:
In my case I had to generate a new page access token because I changed my Facebook password.
You can do that by going to https://developers.facebook.com, click on your app, see the menu on the left, choose Messenger, then Settings, then scroll to Access Tokens, click Generate token, copy the token and paste it into your configuration file.