Extend Facebook Open Graph Token For Posting to Pages - php

I'm using this tutorial (from the first answer on that page).
In short it uses a FB app, and PHP CURL GET to post to your Facebook page via HTTP. I have it working and can post to my page (as my page) with the correct token.
However, the page access token only lasts an hour, meaning you have to constantly re-authorize by generating a new token. How can I set-and-forget, or otherwise extend my token? I have read the facebook documentation but can't apply it to my scenario.
I just want to authorise once, receive a token and have my web form be able to post to my page.

The & symbol should be replaced with ? (question mark). Then it should work.
ex:
https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id={app-id}&client_secret={app-secret}&fb_exchange_token={short-lived-token}

You get your page access token when you (the admin user) authenticate. The page token is based on your short-lived user token. In order to get a long-lived page token you need to get a long-lived user token. They usually last around two months.
Here's how you get a long-lived page token.
Get a short-lived user token.
Get your app ID and app secret.
Make the following GET call: https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id={app-id}&client_secret={app-secret}&fb_exchange_token={short-lived-token}.
Now use the token returned from step 3 to create a new long-lived page token.

Related

How to generate a permanent (never expiring) facebook user access token?

As the title suggests im wondering how i could obtain a never expiring facebook user access token. Which i would need to create a page access token at a later date. I tried using their graph explorer tool but i could only make it go up to 2 months of expiry date and for my use case that wouldnt be ideal.
To shortly explain my use case, on our website im trying to implement a facebook sharing system where each user could share what they wanted i.e posts on their facebook page (we are not using facebook login and the user would just give acces from their own dev tool panel if thats the correct approach). I got this to work BUT only with a acces token that would expire in 2-3months. So a user having to re-authenicate with our service every 2-3 months isnt ideal and wouldnt really work for us. So is there a way i can refresh that token programtically or does the user have to give a new user access token every couple of months.
I have tried following this answer but with no luck Long Lived access token Facebook Page and many similar answers to this. There is also a suggestion that you should contact facebook if you want a never expiring access token which this user suggested Generate permanent access token Facebook API.
Now im wondering if it even is possible do that in 2021 and if there is anything i missed in regards how to generate said tokens or refresh them.
EDIT:
I used the following requests to get the extended access token.
https://graph.facebook.com/oauth/access_token?client_id=<your FB App ID >&client_secret=<your FB App secret>&grant_type=fb_exchange_token&fb_exchange_token=<your short-lived access token>
After i got the token i used
https://graph.facebook.com/me/accounts?access_token=<your long-lived access token>
to get the extended access token.
To get page access token that never expires, take the following steps:
Get user token
Make this token long-lived, e.g. by clicking "Extend access token" at the bottom of the page: https://developers.facebook.com/tools/debug/accesstoken/
Then, use this token to get page access token.
In Access Token Debugger the token will be marked as "Expires: never"

Can I indefinitely generate access tokens using one refresh token in Google API

I'm kinda confused using Google API
I've a FORM on my website for booking events on my public calendar. Whenever a user books an event, I make a call to get an Access Token (using Client ID & Secret and Refresh Token), but using the same Refresh Token that I generated initially. For every new Access Token, I'm using the same Refresh Token. It's all working fine. But I don't understand the flow.
Do I need to generate a new Refresh Token on every call? What are some limitations of not doing so? Can I keep on generating Access Token with the same Refresh Token indefinitely? Thanks!
Refresh tokens are long lived they can expire if the user who's account was used to create it removes access. If its not used in the last six months google will also expire the refresh token. Here is one that is a bit tricky if you use the client id to request access of the user you get a refresh token if you do it again you get another refresh toke technically both refresh tokens work you can do this up to 50 times on the 51's time the first one will be expired. You can use a refresh token as many times as you want to get a new access token.
My question for you is who's google calendar are you writing to the users or some default one on your website? If this is a central Google calendar that you are writhing to then you should consider using a service account rather than Oauth2. I have an article on how service accounts are used if you are interested. Google Developer service accounts

How to post to my own page using the Facebook API

I would like to post updates to a Facebook Page I own, using the API.
I followed the instructions in this answer to obtain:
a short-lived access token for my user, making sure to grant permissions for publish_stream and manage_pages
a long-lived access token, which the token debugger actually shows as never expiring
a Permanent Page Access Token specific for my page, which again is shown as never expiring
I can use the long-lived access token to post to my wall, but neither that nor the specific page access token allow me to post to my page.
If I try to use the personal long-lived access token to post to my Page ID, it returns OK and an actual post ID, but the post never appears on the page.
If I try to use the page access token to post either to /me/feed (which should be the page) or to the page ID, I get #200 The user hasn't authorized the application to perform this action which I clearly did.
What am I doing wrong?
Do I need to submit my app for review? How can I do so, when I don't even have an "app"? It has no public facing website, nothing, because it's only a single script for my own personal use, which I'd like to use to update my page.
according to the docs you will need publish_pages permission to post as page from api v2.3 . Prior, it needed permission publish_actions in addition to manage_pages. Now they have introduced publish_pages specifically for that purpose. .
A page access token with publish_pages permission can be used to
publish new posts on behalf of that page. Posts will appear in the
voice of the page.

Refresh token in Oauth2.0

I am making an OAuth 2.0 request and it is returning me JSON with refresh_token and access_token, why are there are 2 in OAuth2.0?
Which one is short lived?
What is the purpose of both?
I read this question on SO but that didn'e helped me much, Any help in this regard will be appreciated
Thanks
The access token is what you will use to authenticate your service requests. It generally contains details about the user or is directly mapped to the permissions about the user and the permissions that he has granted.
These tokens are short lived - something like one hour, the actual duration differs per provider.
The refresh tokens on the other hand are used to get a new access token when the one that you have expires. They have a much longer (sometime infinite, until explicitly revoked) lifetime.
Now, let's consider an end to end scenario. Let's say you create an app that does Facebook actions on a user's behalf - post on their timeline etc.
Your app redirects the user to log in to Facebook - you use Facebook SDK for this.
When the user successfully logs in and gives you the required permissions (post on timeline) you get an access token and a refresh token.
Your app can now hit the Facebook API to post on the user's timeline on his behalf with the access token. This token can be used for one hour (or whatever time the access token is valid)
Once the token is about to expire, you can hit a Facebook API to refresh the access token, as this one is about to expire. So, you call into the API with refresh + access tokens.
The API returns a new access token to you - you can use this now till it expires.
PS - This is not how it happens for Facebook actually. This was just a random example to explain how refresh and access tokens differ.
If this makes sense, go back to the question that you have linked. It has some really good answers. :)

facebook page access token

I'm trying to make aplication which get the posts of facebook page. I did everything and it is working fine but I have problem wih access token. I've tried some SO answers about making FB APP but it didn't worked for me. I got to point when my token expired then refreshed page but the page asked me to verify access. But I cannot have it like this, because it doesnt serve the purposse.
Now I'm taking the content from this url with file_get_contents("https://graph.facebook.com/soecz/posts?access_token=CAACEdEose0cBAJrnTKwdTdaloBgShsNSIkJjspgQocumZB4CV4mZACpAo3xj57gYcVYYYeHDBxi2ltNCT7SZB0Yl51PBQCrInIKstadeRR5OidYG8pibAAUHIiC51QUxgfTgFMY4DLUlglda7YiaP5yQiYbRftxwipRK5MZBVyzags0eReHx");
But after 2 hrs the token expires and I got oath error. Do you ahve any solutions ? I will sue it to get the posts from page. I do not want to edit / post anything with this. Just get the posts and write them. Also I do not want to rediret users when the token expires. Thanks for solutions
See scenario 5 of https://developers.facebook.com/roadmap/offline-access-removal/. By extending the 2 hour (short lived) token for a 2 month (long lived) token you can query for the page token after which will not expire.
Exchange the short-lived user access token for a long-lived access token using the endpoint and steps explained earlier. By using a long-lived user access token, querying the [User ID]/accounts endpoint will now provide page access tokens that do not expire for pages that a user manages. This will also apply when querying with a non-expiring user access token obtained through the deprecated offline_access permission.
So you will only need to "verify" once as a user then you can save the page access token after that.

Categories