2

I a bit confused. I'll be glad if someone could clarify it to me -

What are the differences between the the token that I get in the following ways:

  1. Getting a token in this way: https://graph.facebook.com/oauth/access_token? client_id=YOUR_APP_ID &client_secret=YOUR_APP_SECRET &grant_type=client_credentials
  2. Versus getting a token using Javascript SDK - FB.getAuthResponse()['accessToken']

They both look different, and I don't understand which should I use.

Thanks!

1
  • Be careful with the client_secret=YOUR_APP_SECRET, you MUST NOT use this in client-side code (e.g. javascript in browser, mobile apps).
    – Gan
    Jan 29, 2013 at 10:52

1 Answer 1

2

The first method is documented under Login as an App in facebook documentation:

Logging in as an App allows you to obtain an access token which allows you to make requests to the Facebook API on behalf of an App rather than a User. This is useful, for example to modify the parameters of your App, create and manage test users, or read your application's insights for example. App access tokens can also be used to publish content to Facebook on behalf of a user who has granted a publishing permission to your application.

As mentioned in the documentation, you should only use this method in server-side coding, where your code is more secured from malicious attackers (compared to client-side code). Remember: it is important that your App Secret is never shared with anyone. Think of the app secret as your application account password. If other people got your app secret, your application can be compromised. This method corresponds to the Client Credential Grant in OAuth 2.0.

The second method is for client-side apps that may not have server-side coding. This allows your app to make API calls on behalf of an authorized user. Under the SDK's cover, this method corresponds to Implicit Grant in OAuth 2.0.

By now, you should know that the existence of the two methods is because facebook adopts OAuth 2.0.

In order to fully understand the usages and differences between the two methods, I strongly recommend you to read up RFC 6749 - The OAuth 2.0 Authorization Framework. If you find the text difficult to read, you can use some easy reading apps, like Evernote Clearly on Google Chrome. For a simplified, easier-to-understand version of OAuth 2.0, you can read up OAuth 2 Simplified by Aaron Parecki.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.