As I understand it, recently Facebook has decided to remove the offline_access
permission and has introduced a concept called long-lived access tokens which last a maximum of 60 days. Is there anyone who knows how to get this access token with the Facebook JavaScript SDK?
There is a way to extend this to 60 days. described here: https://developers.facebook.com/docs/roadmap/completed-changes/offline-access-removal/
under Scenario 4: Client-side OAuth and Extending Access_Token Expiration Time through New Endpoint
Edit: In order to extend the access token you need to make the following request with your short lived access token:
https://graph.facebook.com/oauth/access_token?
client_id=APP_ID&
client_secret=APP_SECRET&
grant_type=fb_exchange_token&
fb_exchange_token=EXISTING_ACCESS_TOKEN
-
1Do I need to exchange my current access_token to get new access token when my current one expair every time after 60 days. Now when I pass offline_access as scop parameter seems to be it is not considering it and simply my access token is expaired within couple of hours. Can you explain how I get long live access token through facebook JavaScript sdk. Are there any settings or special parameters that I need to send along with. – Ananda Subasinghe May 7 '12 at 3:34
-
3You cannot get a 60 day access token using the js sdk. You can only extend it to 60 days after receiving the short lived access token first. – Yan Berk May 9 '12 at 8:19
-
2And is there a way to extend this 60 days again without user interaction? – Glooh May 10 '12 at 11:08
-
3Note that according to developers.facebook.com/docs/facebook-login/access-tokens, because this request sends the APP_SECRET (and retrieves a long-lived user token) it should NOT be done client side, but rather on the server. – Excalibur Jul 31 '13 at 19:42
-
2@Excaliber: Sending the APP_SECRET as a get parameter still a little risky. It's visible in route and could be stored in access logs. It would be much better to send as a post parameter. Since this is an https call it would then be encrypted. Maybe facebook implemented it this way because of Same-origin / Cross domain rules. Would be nice if they put it in their server side SDKs instead. – Dan Feb 6 '14 at 15:51
Due to a bug in Facebook, some users will have to unauthorize the app before Facebook will issue the long-lived tokens.
I just made a Facebook Graph API call using 'axios'. You can find the client_id and client_secret from your App Dashboard.
getLongLiveToken = () => {
window.FB.getLoginStatus(function(response) {
if (response.status === 'connected') {
let userAccessToken = response.authResponse.accessToken;
axios.get(`https://graph.facebook.com/oauth/access_token?client_id=${clientId}&client_secret=${clientSecret}&grant_type=fb_exchange_token&fb_exchange_token=${userAccessToken}`)
.then((response) => {
console.log("Long Live Access Token");
console.log(response.data.access_token);
});
}
});
}
<button onClick={ () => this.getLongLiveToken() } >Long Live Token</button>
add function to the javascript with following details: i hope it's works for you.
function getLongLiveToken(data){
FB.api('oauth/access_token', {
client_id: data.client_id, // FB_APP_ID
client_secret: data.secret, // FB_APP_SECRET
grant_type: 'fb_exchange_token',
fb_exchange_token: data.access_token // USER_TOKEN
}, function (res) {
if(!res || res.error) {
console.log(!res ? 'error occurred' : res.error);
}else{
var accessToken = res.access_token;
if(typeof accessToken != 'undefined'){
}
}
});
}
-
2Don't do the call from client side, send the short token to server and use something of this sort in the backend as it contains the app secret. – meain Apr 4 '17 at 14:42
-
Can you tell !!! Which of programming language you are preferred for it. – Ankur Rupapara Apr 4 '17 at 18:56
-
1