57

As I understand it, recently Facebook has decided to remove the offline_access permission and has introduced a concept called long-lived access tokens which last a maximum of 60 days. Is there anyone who knows how to get this access token with the Facebook JavaScript SDK?

4 Answers 4

108

There is a way to extend this to 60 days. described here: https://developers.facebook.com/docs/roadmap/completed-changes/offline-access-removal/ under Scenario 4: Client-side OAuth and Extending Access_Token Expiration Time through New Endpoint

Edit: In order to extend the access token you need to make the following request with your short lived access token:

https://graph.facebook.com/oauth/access_token?             
    client_id=APP_ID&
    client_secret=APP_SECRET&
    grant_type=fb_exchange_token&
    fb_exchange_token=EXISTING_ACCESS_TOKEN 
10
  • 1
    Do I need to exchange my current access_token to get new access token when my current one expair every time after 60 days. Now when I pass offline_access as scop parameter seems to be it is not considering it and simply my access token is expaired within couple of hours. Can you explain how I get long live access token through facebook JavaScript sdk. Are there any settings or special parameters that I need to send along with. May 7, 2012 at 3:34
  • 3
    You cannot get a 60 day access token using the js sdk. You can only extend it to 60 days after receiving the short lived access token first.
    – Yan Berk
    May 9, 2012 at 8:19
  • 2
    And is there a way to extend this 60 days again without user interaction?
    – Glooh
    May 10, 2012 at 11:08
  • 3
    Note that according to developers.facebook.com/docs/facebook-login/access-tokens, because this request sends the APP_SECRET (and retrieves a long-lived user token) it should NOT be done client side, but rather on the server.
    – Excalibur
    Jul 31, 2013 at 19:42
  • 2
    @Excaliber: Sending the APP_SECRET as a get parameter still a little risky. It's visible in route and could be stored in access logs. It would be much better to send as a post parameter. Since this is an https call it would then be encrypted. Maybe facebook implemented it this way because of Same-origin / Cross domain rules. Would be nice if they put it in their server side SDKs instead.
    – Dan
    Feb 6, 2014 at 15:51
12

Due to a bug in Facebook, some users will have to unauthorize the app before Facebook will issue the long-lived tokens.

2
  • 11
    Confirmed. After 7 hours of banging my head against the screen, removed the App from my account and the long-live token was returned.
    – Costa
    Aug 9, 2012 at 4:29
  • Is this "Error validating client secret" error even though client secret is correct?
    – scott
    Feb 17, 2018 at 12:19
0

I just made a Facebook Graph API call using 'axios'. You can find the client_id and client_secret from your App Dashboard.

getLongLiveToken = () => {
    window.FB.getLoginStatus(function(response) {
        if (response.status === 'connected') {
            let userAccessToken = response.authResponse.accessToken;
            axios.get(`https://graph.facebook.com/oauth/access_token?client_id=${clientId}&client_secret=${clientSecret}&grant_type=fb_exchange_token&fb_exchange_token=${userAccessToken}`)
            .then((response) => {
                console.log("Long Live Access Token");
                console.log(response.data.access_token);
             });
           }
       });
    }
<button onClick={ () => this.getLongLiveToken() } >Long Live Token</button>
-2

add function to the javascript with following details: i hope it's works for you.

function getLongLiveToken(data){

        FB.api('oauth/access_token', {
            client_id: data.client_id, // FB_APP_ID
            client_secret: data.secret, // FB_APP_SECRET
            grant_type: 'fb_exchange_token',
            fb_exchange_token: data.access_token // USER_TOKEN
        }, function (res) {
            if(!res || res.error) {
                console.log(!res ? 'error occurred' : res.error);
            }else{
                var accessToken = res.access_token;
                if(typeof accessToken != 'undefined'){
                }
            }
        });
    }
3
  • 2
    Don't do the call from client side, send the short token to server and use something of this sort in the backend as it contains the app secret.
    – meain
    Apr 4, 2017 at 14:42
  • Can you tell !!! Which of programming language you are preferred for it. Apr 4, 2017 at 18:56
  • 1
    Use whatever you use in the backend, I personally use python.
    – meain
    Apr 5, 2017 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.