11

Is it possible to decrypt Facebook's new OAuth 2.0 access_token ?

I need to somehow get user_id and app_id from the access_token.

PS:

I need to get the user_id and app_id ONLY from the access_token as Facebook Linter used to do.

4
  • 1
    You have to use a registered app_id to get an access_token, and you can get user_id from the access_token by accessing the Graph API URL /me/. Any reason you don't have / can't get the data you want without trying to decrypt the access_token?
    – jches
    Sep 5, 2011 at 15:26
  • I need to get the user_id and app_id ONLY from the access_token as Facebook Linter used to do.
    – glarkou
    Sep 5, 2011 at 18:06
  • 1
    Please clarify your question and detail what you want to do. user_id and app_id are prerequisites for the access_token so it is nonsensical to reverse this. As other have outlined, you can always make a simple API call to /me/ to retrieve the associated user_id as long as the token is valid. If the token is not valid anymore, you're out of luck.
    – kongo09
    Sep 7, 2011 at 7:40
  • You're probably confusing the access_token with the signed_request passed to your application. The signed_request has to be decoded and contains an access_token only if the user is logged in and has given your application permission to access their account. The signed_request also contains the 'user_id' if their is a user session. The signed_request is only available in the canvas context on the initial POST load where your app is loading in a facebook iframe.
    – qodeninja
    Jun 28, 2012 at 19:00

8 Answers 8

24
+50

As others have already pointed out, the access_token is a unique random string, so it cannot be decrypted as such. Also, we all know that the user_id and app_id are prerequesites to generate the token in the first place.

However, let's assume you stored your token(s) in a database and lost the associated user_id and app_id. In that case, it is a valid question on how to retrieve them having only the token at hand. If your token is still valid, this is possible. If it is expired, you're out of luck.

To retrieve the user_id, make a call to:

https://graph.facebook.com/me?fields=id&access_token=xxx

To retrieve the app_id, make a call to:

https://graph.facebook.com/app?fields=id&access_token=xxx

In both cases, the associated id's will be part of the JSON response, regardless of the access_token being an encrypted or unencrypted one.

Let's illustrate this with an example. Let's assume Mark Zuckerberg uses the Graph API Explorer to generate an access_token. Calling the /me endpoint gives you:

{
  "id": "68310606562"
}

and calling the /app endpoint gives you:

{
  "id": "145634995501895"
}

The ids you were looking for are part of the response.

Please note that this does not work with the access_token shown on https://developers.facebook.com/apps (not sure if this is a Facebook mistake or intentional). Please use the access_token that your app receives via OAuth.

10
  • I think that this is what I am looking for. I ll try it and let you know.
    – glarkou
    Sep 7, 2011 at 8:54
  • If I point my browser to https://graph.facebook.com/me?fields=id&access_token=xxx with an encrypted access_token I get { "error": { "type": "OAuthException", "message": "Error validating application." } }
    – glarkou
    Sep 7, 2011 at 9:06
  • Are you sure, your access_token is still valid?
    – kongo09
    Sep 7, 2011 at 11:12
  • Yes mate. It is valid. It does that for every request if the access_token is encrypted.
    – glarkou
    Sep 7, 2011 at 11:35
  • I'd love to help, but I don't understand. These are plain standard API calls. There is no reason why they would fail for an encrypted access_token unless the token is not valid. Otherwise, the token would be totally useless. Can you actually do anything with your token?
    – kongo09
    Sep 7, 2011 at 13:31
2

If the access token is in the encrypted format, there's no programmatic way to determine the User ID and App ID.

I struggle to think of a legitimate way you could have come across an access token without already having those two pieces of information since presumably you know your own App ID and the User ID you stored the access token against.

Nevertheless, assuming there's a legitimate use-case for this: a call to /me?fields=id will return the user ID and/or you can use the debug tool at https://developers.facebook.com/tools/debug to debug the other properties of the access token

4
  • Unfortunately the debug tool is not working with the encrypted access_token. That was the initial problem.
    – glarkou
    Sep 6, 2011 at 0:41
  • The debug tool should be working with all access tokens, i suggest filing a bug at bugs.developers.facebook.net if you haven't already done so
    – Igy
    Sep 6, 2011 at 1:06
  • graph.facebook.com/me/… claims the access_token is encrypted i.e. "message": "The access token could not be decrypted",
    – evandrix
    Aug 1, 2018 at 19:57
  • Then what you have probably isn't a valid access token - if it was, maybe your app secret changed and the old token isn't compatible?
    – Igy
    Aug 2, 2018 at 20:14
0

Generally you use the access_token to access other data from your application. So for example, your application would authenticate the user then use the access token to access other functions in FB's API, such as the graph:

https://graph.facebook.com/me?access_token=<access_token>
2
  • I know how to use it. I want to be able to get user_id and app_id from access token as before..
    – glarkou
    Sep 3, 2011 at 2:54
  • Yes, you get the user_id from the graph using that address "graph.facebook.com/me" and the app_id is a static ID which you should know from setting your app up anyway. Alternatively you can use one of Facebook's SDKs which makes all of this much easier.
    – Ben
    Sep 3, 2011 at 2:57
0

There is no public way of decrypting an access token to get the user id and app id. This is also very likely a massive breach of Facebook policy.

To get an access token in the first place you have to have access to the user and the app id anyway so you shouldn't need to do this. If you don't actually have access to the user or the app id then my guess would be you probably shouldn't even have their access token and have probably obtained it 'illegally'...

0

This is actually a very simple task, if you look closely at the access token itself. It consists of 3 segments, separated by a pipe character, |:

APP_ID|SOME_STUFF.NUMBER-USERID|SOME_MORE_STUFF

I'm not sure what SOME_STUFF, NUMBER, and SOME_MORE_STUFF are; presumably timestamps, signatures, or other encoded data that facebook uses to keep track of the access_token's validity and so on.

Unless you've obtained the acces_token in question by fowl means, I don't see a problem with being able to access the APP_ID and USER_ID from them (and neither does Facebook, apparently). So all I'll say on that is be responsible :)

The other thing to keep in mind is that this isn't a standard or anything, and is subject to change. So, watch out for that, too.

5
  • That was the case before Facebook introduced the encrypted access_token. I used that before.
    – glarkou
    Sep 6, 2011 at 0:42
  • Interesting; somehow I wasn't aware of this change. The roadmap says by Sept 1st access_token will be encrypted, but my apps are still getting the unencrypted token. Guess I should upgrade them :P
    – jches
    Sep 6, 2011 at 0:55
  • Guess that you have Encrypted Access Token: Disable in the Advance Settings :p
    – glarkou
    Sep 6, 2011 at 1:17
  • That I did...interesting I never noticed that setting. In that case you're probably out of luck; it would be pretty pointless to encrypt the access_key if the encryption was easy to break; you could try asking over at crypto.stackexchange.com
    – jches
    Sep 6, 2011 at 21:41
  • Either way if the token is stolen it can be used, so I don't know why they did it. I asked though; maybe there's someone who knows something I don't.
    – jches
    Sep 6, 2011 at 22:30
0

you don't have to decrypt accesstoken

As far as AppID is concerned,you should get it from facebook whn you make an app there,its your id to connect to facebook.

facebook sends the userId along with accesstoken.. just check your cookies in browser or in oauth case check entire string returned when request for acess token.

0

Are you sure you're talking about the Access Token here and not the signed request?

When you're Facebook Application is loaded you have a signed request object, which has the information I believe you are looking for (however if the user has not authorized your application their user ID will not be in the signed request, Facebook security)

0

The only way currently available is to use to Facebook Access Token Lint Tool. You can consider to automate the process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.