As I understand it, recently Facebook has decided to remove the offline_access
permission and has introduced a concept called long-lived access tokens which last a maximum of 60 days. Is there anyone who knows how to get this access token with the Facebook JavaScript SDK?
4 Answers
There is a way to extend this to 60 days. described here: https://developers.facebook.com/docs/roadmap/completed-changes/offline-access-removal/
under Scenario 4: Client-side OAuth and Extending Access_Token Expiration Time through New Endpoint
Edit: In order to extend the access token you need to make the following request with your short lived access token:
https://graph.facebook.com/oauth/access_token?
client_id=APP_ID&
client_secret=APP_SECRET&
grant_type=fb_exchange_token&
fb_exchange_token=EXISTING_ACCESS_TOKEN
-
1Do I need to exchange my current access_token to get new access token when my current one expair every time after 60 days. Now when I pass offline_access as scop parameter seems to be it is not considering it and simply my access token is expaired within couple of hours. Can you explain how I get long live access token through facebook JavaScript sdk. Are there any settings or special parameters that I need to send along with. May 7, 2012 at 3:34
-
3You cannot get a 60 day access token using the js sdk. You can only extend it to 60 days after receiving the short lived access token first.– Yan BerkMay 9, 2012 at 8:19
-
2And is there a way to extend this 60 days again without user interaction?– GloohMay 10, 2012 at 11:08
-
3Note that according to developers.facebook.com/docs/facebook-login/access-tokens, because this request sends the APP_SECRET (and retrieves a long-lived user token) it should NOT be done client side, but rather on the server. Jul 31, 2013 at 19:42
-
2@Excaliber: Sending the APP_SECRET as a get parameter still a little risky. It's visible in route and could be stored in access logs. It would be much better to send as a post parameter. Since this is an https call it would then be encrypted. Maybe facebook implemented it this way because of Same-origin / Cross domain rules. Would be nice if they put it in their server side SDKs instead.– DanFeb 6, 2014 at 15:51
Due to a bug in Facebook, some users will have to unauthorize the app before Facebook will issue the long-lived tokens.
I just made a Facebook Graph API call using 'axios'. You can find the client_id and client_secret from your App Dashboard.
getLongLiveToken = () => {
window.FB.getLoginStatus(function(response) {
if (response.status === 'connected') {
let userAccessToken = response.authResponse.accessToken;
axios.get(`https://graph.facebook.com/oauth/access_token?client_id=${clientId}&client_secret=${clientSecret}&grant_type=fb_exchange_token&fb_exchange_token=${userAccessToken}`)
.then((response) => {
console.log("Long Live Access Token");
console.log(response.data.access_token);
});
}
});
}
<button onClick={ () => this.getLongLiveToken() } >Long Live Token</button>
add function to the javascript with following details: i hope it's works for you.
function getLongLiveToken(data){
FB.api('oauth/access_token', {
client_id: data.client_id, // FB_APP_ID
client_secret: data.secret, // FB_APP_SECRET
grant_type: 'fb_exchange_token',
fb_exchange_token: data.access_token // USER_TOKEN
}, function (res) {
if(!res || res.error) {
console.log(!res ? 'error occurred' : res.error);
}else{
var accessToken = res.access_token;
if(typeof accessToken != 'undefined'){
}
}
});
}
-
2Don't do the call from client side, send the short token to server and use something of this sort in the backend as it contains the app secret.– meainApr 4, 2017 at 14:42
-
Can you tell !!! Which of programming language you are preferred for it. Apr 4, 2017 at 18:56
-
1