3

This is the access token associated with my Facebook application -- the thing that comes back from https://graph.facebook.com/oauth/access_token?grant_type=client_credentials&client_id=APP_ID&client_secret=APP_SECRET. Can I get this once from FB and save it away somewhere for future use, or do I need to refresh it on a regular basis?

5 Answers 5

19

Access Token Tool - Facebook Developers

App tokens do not expire and should be kept secret as they are related to your app secret.

0
0

I don't know for sure, but since the documentation does not state that you get back an expiration time for the access token, I guess that it's an educated guess that it does not expire.

But why does it matter? the application authentication process is much simpler than the one with users, so just save the token somewhere (db, memory) and then try an api call, if it fails just issue one call to obtain a new token, save that, and continue as usual.

2
  • How would you check for the error code + message for the access_token, since it doesn't appear to expire currently? How would you know that the error from the call is related to the app access_token specifically?
    – Trace
    Commented Mar 3, 2017 at 11:14
  • 1
    @KimGysen I haven't been doing any facebook api work for a few years now (the answer is 4+ years old), but looking at the documentation of Debugging and Error Handling > Expired or invalid access tokens it seems that the code is 190 and the type is OAuthException. Commented Mar 3, 2017 at 13:12
0

If you want a token to manage a page, never-expiring token can be obtained by

  1. Get user token
  2. Exchange user token to long-living token (Valid for 30days)
  3. Obtain a page token with this user token (This page token is not going to expire)

When you check the token you've got, check it on Debugger. You will now see 'Expires Never'.

Documentation is on Facebook Developers ,Scenario 5: Page Access Tokens

0

My app access token does not seem to have changed for just under a month. I do not know if it changes. For fun I just changed my app secret...

My app access token then immediately changed and when I try to use the old one I get a HTTP 400 error with a message body...

{"error":{"message":"Invalid OAuth access token signature.","type":"OAuthException","code":190}}

My advice is save the access token and use it. Unless you get the message above in which case obtain a new one and use that. One thing that I have not checked yet is if you get the same result if the user access token (that you may be querying) has expired instead.

-2

For each and every user token (which is what you're getting from your link), there is an expiration date. Take one of those tokens to https://developers.facebook.com/tools/debug and debug it. You will see that generally they expire within 60 minutes or so.

To extend that user token, call the exchange command (https://developers.facebook.com/docs/offline-access-deprecation/) to get it to become a 60 day token. That user token has to be still valid (not expired) to do this.

6
  • Not a user token, an application token, it says here: "In addition to User Login, Facebook Platform support App Login using the OAuth 2.0 Client Credential flow. App Login allows you to take various administrative actions for your app, such as retrieving Insights data or approving Requests." Commented Feb 22, 2012 at 19:46
  • Did you lint the app access token using the debug tool? What did it say for expiration?
    – DMCS
    Commented Feb 22, 2012 at 21:03
  • If I try I get this message: "Facebook URLs aren't scrapable by this Debugger. Try your own.", however the Access Token Debugger does have info about the app access token and it does have an expiration date, but when I curl for that url I get only an access token, with no expire. Commented Feb 22, 2012 at 21:56
  • /tools/debug gives me a single line: "App ID: [my app id] : [my app name]" -- nothing about expiration. I've also done the oauth/access_token call in the original question twice with curl, over two hours apart, and have gotten the same result both times. So far, I'm not seeing any evidence of expiration.
    – Jim Miller
    Commented Feb 22, 2012 at 22:08
  • Is the token just a concatenation of your app id, a pipe, and then some random looking characters? If so, then there's no expiry of that app access token. user access tokens do expire. Very sorry for any confusion I've made.
    – DMCS
    Commented Feb 22, 2012 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.