Home » Misc » How to get facebook authentication token

How to get facebook authentication token


Authentication - Marketing API - Documentation

Both Graph API and Marketing API calls require an access token to be passed as a parameter in each API call. In this guide, we teach you how to get access tokens for testing purposes.

To learn more about authentication, see our main documentation:

  • Access Tokens - User Access Token, App Access Token, Page Access Token, and Client Token.
  • Long-Lived Tokens
  • Debugging & Errors
  • Session Info Access Tokens
  • Portability

Graph API Explorer

You can get a test user access token with Graph API Explorer. To learn how to use the explorer, see Graph API Explorer Guide.

Obtain User Access Token

  1. Go to Graph API Explorer.
  2. In Facebook App, select an app used to obtain the access token.
  3. In User or Page, select User Token.
  4. Under Permissions, check ads_read.
  5. Click Generate Access Token. The box on top of the button is populated with the access token.
  6. Store that token for later use.

Debug

To get more information in the token you just generated, click on the i button shown before the token. After the click, a pop-up screen opens and displays some basic information about the token. Click on Open in Access Token Tool to be redirected to the Access Token Debugger.

You can also directly access the Access Token Debugger and paste the token you generated in the text box.

While debugging, check:

  • App ID: The app ID mentioned in the prerequisite section.
  • Expires: A time stamp. A short-lived token expires in an hour or two
  • Scopes: Contains the permissions added on Graph API Explorer.

Extend Access Token

  1. Complete all steps to obtain the access token using the Graph API Explorer.
  2. Copy your token. Paste it in the text box on the Access Token Debugger.
  3. On the Access Token Debugger, scroll all the way down to the bottom of the page.
  4. Click Extend Access Token to get a long-lived token. Copy that token for later use.

Check your new token’s properties using the Access Token Debugger. It should have a longer expiration time, such as 60 days, or Never under Expires. See Long-Lived Access Token.

Get token manually

If the user clicks the Allow button when you prompt for the extended permissions, the user is redirected to a URL that contains the value of the redirect_uri parameter and an authorization code:

http://YOUR_URL?code=<AUTHORIZATION_CODE>

Build a URL that includes the endpoint for getting a token, your app ID, your site URL, your app secret, and the authorization code you just received. The URL will be similar to the following:

https://graph.facebook.com/<API_VERSION>/oauth/access_token? client_id=<YOUR_APP_ID> &redirect_uri=<YOUR_URL> &client_secret=<YOUR_APP_SECRET> &code=<AUTHORIZATION_CODE>

The response should contain the access token for the user:

  • If you follow the server-side authentication flow, you get a persistent token.
  • If you follow the client-side authentication flow, you get a token with a finite validity period of about one to two hours. This can be exchanged for a persistent token by calling the Graph API endpoint for Extending Tokens.

If the API is to be invoked by a System User of a business, you can use a System User Access Token.

You can debug the access token, check for expiration, and validate the permissions granted using the access token debugger or the programmatic validation API.

Store Token

The token should be stored in your database for subsequent API calls. You should regularly check for validity of the token, and if necessary prompt the user for permission. Even a persistent token can become invalid in a few cases including the following:

  • The user’s password changes
  • The user revokes permissions

As access tokens can be invalidated or revoked anytime, your app should expect to have a flow to re-request permission from the user. When a user starts your web app, check the validity of the token you have for that user. If necessary, send them through the authentication flow to get an updated token.

If this is not possible for your app, you may need a different way to prompt the user. This can happen in cases where the API calls are not directly triggered by a user interface, or are made by periodically run scripts. A possible solutions is to send users an email with instructions.

Get Long-Lived Tokens - Facebook Login - Documentation

Default User and Page access tokens are short-lived, expiring in hours, however, you can exchange a short-lived token for a long-lived token.

When you use the iOS, Android, or JavaScript SDK, the SDK will automatically refresh tokens if the person has used your app within the last 90 days. Native mobile apps using Facebook's SDKs get long-lived User access tokens, good for about 60 days. These tokens are refreshed once per day, when the person using your app makes a request to Facebook's servers. If no requests are made, the token will expire after about 60 days and the person will have to go through the login flow again to get a new token.

Latest Graph API Version: v15.0

Get a Long-Lived User Access Token

If you need a long-lived User access token you can generate one from a short-lived User access token. A long-lived token generally lasts about 60 days.

You will need the following:

  • A valid User Access Token
  • Your App ID
  • Your App Secret

Query the GET oauth/access_token endpoint.

curl -i -X GET "https://graph.facebook.com/{graph-api-version}/oauth/access_token? grant_type=fb_exchange_token& client_id={app-id}& client_secret={app-secret}& fb_exchange_token={your-access-token}"
Sample Response
{ "access_token":"{long-lived-user-access-token}", "token_type": "bearer", "expires_in": 5183944 //The number of seconds until the token expires }

The workflow for generating a long-lived User access token is as follows:

Once you have retrieved the long-lived token, you can use it from your server or send it back to the client to use there.

Caveats

  • You can not use an expired token to request a long-lived token. If the token has expired, your app must send the user through the login flow again to regenerate a new short-lived access token.

  • Make this call from your server, not a client. Your app secret is included in this API call, so you should never make the request client-side. Instead implement server-side code that makes the request, then pass the response containing the long-lived token back to your client-side code. This will be a different string than the original token, so if you're storing these tokens, replace the old one.

  • Do not use the same long-lived tokens on more than one web client (i.e. if the person logs in from more than one computer). Instead, you should use the long-lived tokens on your server to generate a code and then use that to get a long-lived token on the client. Please see below for information Generating long-lived tokens from server-side long-lived tokens.

Get a Long-Lived Page Access Token

If you need a long-lived Page access token, you can generate one from a long-lived User access token. Long-lived Page access token do not have an expiration date and only expire or are invalidated under certain conditions.

You will need the following:

  • A valid long-lived User access token. The person requesting the token must have a role on the Page.

Query the GET {app-scoped-user-id}?accounts endpoint.

curl -i -X GET "https://graph.facebook.com/{graph-api-version}/{app-scoped-user-id}/accounts? access_token={long-lived-user-access-token}"
Sample Response
{ "data":[ { "access_token":"{long-lived-page-access-token}", "category":"Brand", "category_list":[ { "id":"1605186416478696", "name":"Brand" } ], "name":"Cute Kitten Page", "id":"{page-id}", "tasks":[ "ANALYZE", "ADVERTISE", "MODERATE", "CREATE_CONTENT", "MANAGE" ] } ], "paging":{ "cursors":{ "before":"MTM1MzI2OTg2NDcyODg3OQZDZD", "after":"MTM1MzI2OTg2NDcyODg3OQZDZD" } } }

Get Long_lived Tokens for Clients

Facebook has an option for getting long-lived access tokens for apps to avoid triggering Facebook's automated spam systems. Apps that:

  • Have their own authentication system (use a username/password for example)
  • Store a Facebook access token on their servers for people using different clients (browser or native mobile apps)
  • Make API calls from all these different clients

At a high level, you obtain a long-lived token for the client by:

  1. Using a valid, long-lived access token, your server sends a request to get a code from Facebook.
  2. Facebook sends a code back to your server and you securely send this code to the client.
  3. The client uses this code to request a long-lived token from Facebook.
  4. Facebook sends the client a long-lived token which is used to post stories or query data.

Get a Code

Query the GET oauth/client_code endpoint. The redirect URI must be the exact value you set in your app dashboard under the Facebook Login > Settings Client > OAuth Settings card. 

curl -i -X GET "https://graph. facebook.com/{graph-api-version}/oauth/client_code? client_id={app-id}& client_secret={app-secret}& redirect_uri={app-redirect-uri}& access_token={long-lived-user-access-token}"
Sample Response
{ "code":"{code-for-your-client}" }

Redeem the Code for a Long-lived Access Token

Once you've retrieved the code from Facebook's server you then need to ship it to the client via a secure channel. Once that's done, you need to make a request from the client to the /oauth/access_token endpoint:

curl -i -X GET "https://graph.facebook.com/{graph-api-version}/oauth/access_token? code={code-for-your-client}& client_id={app-id}& redirect_uri={app-redirect-uri}& machine_id= {your-client-machine-id}"

The machine_id is an optional parameter that identifies and tracks clients and is used for security and spam prevention. It is a per client not per user value. If you have previously made calls to get a code and been provided a machine_id you should include in your code request.

Sample Response
{ "access_token":"{long-lived-access-token}", "expires_in":5183944, //The number of seconds until the token expires "machine_id":"{your-client-machine-id}" }

The workflow for generating a long-lived token is as follows:

Eternal access token for Facebook - get in 1 minute

A token is a mandatory element of any ICO project. The token is one of the cornerstones of crowdfunding and is essential to attract additional investment to the project. Facebook has something similar. The company has issued a Page Access Token. To get it, you need to perform a number of certain actions.

We will also tell you where to get the longest option. nineOl000 : features

Access Token is translated into Russian as an access token. Login through Facebook is carried out when the user has entered a personal login and password. The system then grants the requested permissions. nine0003

The application receives a special access token. And this ultimately secures the Facebook API. The published Facebook app has the given number of IDs:

  1. APP_ID.
  2. APP_SECRET.

An access token (token) is required to maximize the functionality of the application.

Classification of tokens

Access tokens (AM) are software objects of the operating system of the Microsoft Windows segment. Objects contain session security information that securely identifies a group of users. Tokens are needed to obtain certain user privileges. There are several varieties of access tokens:

  1. User ID. This is the most common Facebook token. This user unit of account is used for a significant part of operations not related to the personal page. In particular, the token is needed for parsing groups, users and publishing data.

  1. MD application. Using this token, you can generate requests to the Facebook API directly from the application. With this option, program parameters are changed and text users are created. This greatly simplifies the management of the computer service and familiarization with the statistics. nine0014

Code example

  1. Page access MD. Very commonly used in Graphs API calls to manage a Facebook page. To generate an element, a user with administrative rights must grant the additional "manage pages" permission. This permission is the basis for obtaining a page access token.

Sample code

  1. Client MD. This token is needed to identify the application. The element is integrated into the binary code of a mobile or computer application. The ID can be used to access a limited number of application-level APIs. Markers are placed in the program bar. nine0014

{app-id}|{client-token}

Example:

access_token=1234|5678

Token expiration time

Tokens are also divided into short-term and long-term. The duration of short-term tokens in most cases ranges from 60 to 120 minutes. Long-term tokens are usually valid for up to two months. However, users should also take into account the factor of a possible technical failure, as a result of which the process of the marker may end earlier, moreover, the disappearance will occur without warning. However, it is worth noting that the developers are actively working to eliminate this shortcoming. nine0003

If the Facebook token is used for parsing, then for the success of this process, you need to master several different techniques. This process supports various functions:

  • Javascript.

Sample code

  • Android.

Sample code

  • iOS.

Sample code

  • Other types of web applications.

Read more here: https://developers.facebook.com/docs/facebook-login/access-tokens/#pagetokens. nine0003

Users can also transfer access tokens. With the help of identifiers, you can send calls to Facebook servers. Personal servers, mobile clients, and browsers are suitable for this process.

Getting and renewing the token

Getting

First you need to get a token. The algorithm for getting it on Facebook is very simple. The procedure will not take much time. And the sequence of actions is as follows:

  1. Go to Facebook Developer, enter your login. nine0014
  2. Click Get Started.
  3. Create an account.
  4. Add a new application to the personal page.
  5. Enter the characters from the security captcha.
  6. Create an ID program.
  7. Go to the "Graph API Explorer" section.
  8. Select the best application you created earlier.
  9. Press the button and get a marker.
  10. Select the page you want from the list that appears.
  11. A token that has been active for 120 minutes is inserted into the string. nine0014
  12. Check the token with a test request.
  13. Wait for a response indicating that the process was successful.

This whole process usually takes no more than three minutes.

Renewal

So how do you renew your token? The order of related actions is as follows:

  1. Click this link for detailed information.
  2. Click Open.
  3. Information on the token will appear in a new page tab. nine0014
  4. Click Renew Access Tokens.
  5. Enter password.
  6. If everything was done correctly, then you have a token that is valid for 60 days.

Verification

How to check the correctness? The best way to check this is in the "Debug" function. Or go to Debug, which contains detailed information about a specialized accounting unit.

Instructions for the page

For the page, the mechanism for obtaining full authorization is also very simple. Access token primarily provides the ability to parse information from Facebook pages. nine0003

The sequence of actions is as follows:

  1. Go to the GUI API section.
  2. Find the application in the drop-down menu.
  3. Click on "Get Access Token".
  4. Determine the optimal resolution.
  5. Connect to an account. In this case, you will need to copy the Access token page.
  6. Enter your personal ID on your page. Place the Access token page in the GET fields section.
    7. nine0011 Activate the type of connection you want (let's say it could be page_ID/events).

U2F tokens - an alternative way to two-factor authentication on Facebook

U2F tokens - an alternative way to two-factor authentication on Facebook - cryptostore.ru

Checkout Continue Shopping

x

Aladdin RD Antivirus Authentication authentication video surveillance video surveillance for home video surveillance for office videos GIS housing and communal services GOST EGAIS ESIA Information protection Instruction Taxpayer cabinet Kontur.Focus CryptoAPM CryptoARM CryptoPRO CryptoPRO CSP CryptoPro CSP CEP Notariat Personal data Submission of documents to the court Rosreestr Rutoken Certificate of signature time tracking system Download CryptoARM for free skud Insurance card reader Tokens smart intercom UEC FSRAR Time stamp Electronic signature electronic signature Electronic document management electronic key

U2F tokens - an alternative way to two-factor authentication on Facebook

Facebook has announced the launch of a new feature for a higher level of protection for personal accounts. Now social network users can authenticate on the site using a special physical drive that works according to the Universal 2nd Factor (U2F) standard and acts as an electronic key.

To log in to their Facebook page, the user needs to insert their unique U2F token into the USB port to unambiguously confirm that they are the owner of the account. nine0003


This authentication method is not only considered more reliable, but also more promising than SMS authentication. It is also important to note that signing in with a U2F token is faster than other account security methods.

Currently, U2F tokens are already used to protect accounts in services such as Google, Dropbox, GitHub, Salesforce, etc.

Earlier on our site we already wrote about the Universal 2nd Factor (U2F) standard. You can read the articles by the #U2F tag. nine0003

Purchase a JaCarta U2F token from a domestic manufacturer of CJSC "Aladdin R.

Learn more