This is the access token associated with my Facebook application -- the thing that comes back from https://graph.facebook.com/oauth/access_token?grant_type=client_credentials&client_id=APP_ID&client_secret=APP_SECRET. Can I get this once from FB and save it away somewhere for future use, or do I need to refresh it on a regular basis?
5 Answers
Access Token Tool - Facebook Developers
App tokens do not expire and should be kept secret as they are related to your app secret.
I don't know for sure, but since the documentation does not state that you get back an expiration time for the access token, I guess that it's an educated guess that it does not expire.
But why does it matter? the application authentication process is much simpler than the one with users, so just save the token somewhere (db, memory) and then try an api call, if it fails just issue one call to obtain a new token, save that, and continue as usual.
-
How would you check for the error code + message for the access_token, since it doesn't appear to expire currently? How would you know that the error from the call is related to the app access_token specifically?– TraceCommented Mar 3, 2017 at 11:14
-
1@KimGysen I haven't been doing any facebook api work for a few years now (the answer is 4+ years old), but looking at the documentation of Debugging and Error Handling > Expired or invalid access tokens it seems that the code is
190
and the type isOAuthException
. Commented Mar 3, 2017 at 13:12
If you want a token to manage a page, never-expiring token can be obtained by
- Get user token
- Exchange user token to long-living token (Valid for 30days)
- Obtain a page token with this user token (This page token is not going to expire)
When you check the token you've got, check it on Debugger. You will now see 'Expires Never'.
Documentation is on Facebook Developers ,Scenario 5: Page Access Tokens
My app access token does not seem to have changed for just under a month. I do not know if it changes. For fun I just changed my app secret...
My app access token then immediately changed and when I try to use the old one I get a HTTP 400 error with a message body...
{"error":{"message":"Invalid OAuth access token signature.","type":"OAuthException","code":190}}
My advice is save the access token and use it. Unless you get the message above in which case obtain a new one and use that. One thing that I have not checked yet is if you get the same result if the user access token (that you may be querying) has expired instead.
For each and every user token (which is what you're getting from your link), there is an expiration date. Take one of those tokens to https://developers.facebook.com/tools/debug and debug it. You will see that generally they expire within 60 minutes or so.
To extend that user token, call the exchange command (https://developers.facebook.com/docs/offline-access-deprecation/) to get it to become a 60 day token. That user token has to be still valid (not expired) to do this.
-
Not a user token, an application token, it says here: "In addition to User Login, Facebook Platform support App Login using the OAuth 2.0 Client Credential flow. App Login allows you to take various administrative actions for your app, such as retrieving Insights data or approving Requests." Commented Feb 22, 2012 at 19:46
-
Did you lint the app access token using the debug tool? What did it say for expiration?– DMCSCommented Feb 22, 2012 at 21:03
-
If I try I get this message: "Facebook URLs aren't scrapable by this Debugger. Try your own.", however the Access Token Debugger does have info about the app access token and it does have an expiration date, but when I curl for that url I get only an access token, with no expire. Commented Feb 22, 2012 at 21:56
-
/tools/debug gives me a single line: "App ID: [my app id] : [my app name]" -- nothing about expiration. I've also done the oauth/access_token call in the original question twice with curl, over two hours apart, and have gotten the same result both times. So far, I'm not seeing any evidence of expiration. Commented Feb 22, 2012 at 22:08
-
Is the token just a concatenation of your app id, a pipe, and then some random looking characters? If so, then there's no expiry of that app access token. user access tokens do expire. Very sorry for any confusion I've made.– DMCSCommented Feb 22, 2012 at 22:43