why can't get user access token (offline) to manage pages? - php

i'm trying to write a script to post to a page while the admin is offline.
my application has the manage_pages extended permission of the admin user.
here is my code:
require('php-sdk/src/facebook.php');
$facebook = new Facebook(array(
'appId' => 'MY_APP_ID', // YOUR APP ID
'secret' => 'MY_SECRET', // YOUR API SECRET
'cookie' => true
));
$user_admin_id = 'MY_ADMIN_ID';
$page_id = 'MY_PAGE_ID';
//get the access token to post to my page via the graph api
$accounts = $facebook->api("/" . $user_admin_id . "/accounts");
foreach ($accounts['data'] as $account)
{
if ($account['id'] == $page_id)
{
//found the access token, now we can break out of the loop
$page_access_token = $account['access_token'];
break;
}
}
but I always get this message:
"Fatal error: Uncaught OAuthException: A user access token is required
to request this resource. thrown in
/home/itrade10/public_html/khodiersoftware/php-sdk/src/base_facebook.php
on line 1033"

You forgot to authorize the User, that´s how you get a User Access Token:
https://developers.facebook.com/docs/reference/php/facebook-getLoginUrl/
Don´t forget to add the "manage_pages" permission in the scope Parameter. You will also have to use the Function "setExtendedAccessToken" of the PHP SDK to extend the User Token. After that, you will get a Page Access Token that is valid forever with the /me/accounts endpoint.
If you used getLoginUrl already, then there´s something wrong with that code, you may want to add it to the question.
Before getting the accounts (with /me/accounts, not with your id), get the User ID:
$user = $facebook->getUser();
If you got a valid User Token, your ID will be in the $user Variable.

maybe this one? https://developers.facebook.com/roadmap/offline-access-removal/ also see Getting long-lived access token with setExtendedAccessToken() returns short lived token

The error message is telling you exactly what the problem is... you need to get a user access token to access your page tokens

Related

FB App This method must be called with a Page Access Token

When i use this code:
<?php
require_once "vendor/autoload.php";
$config = ...;
use FacebookAds\Api;
use FacebookAds\Object\Page;
Api::init(
$config['facebook']['app_id'], //APP_ID
$config['facebook']['app_secret'], //APP SECRET
$config['facebook']['app_access_token'] //Token generated by https://developers.facebook.com/tools/explorer for app
);
$page = new Page($config['facebook']['page_id']);
$leadgen_forms = $page->getLeadgenForms(); //heres an error
I get error:
Fatal error: Uncaught FacebookAds\Http\Exception\AuthorizationException: (#190) This method must be called with a Page Access Token in ...
But when I put page_access_token in place of app_access_token (from https://developers.facebook.com/tools/explorer) i get error: Uncaught FacebookAds\Http\Exception\AuthorizationException: Invalid appsecret_proof provided in the API argument in .... When i remove line:
Seems you are working on lead-gen forms that are meant for pages only. Your profile must have admin/developer role assigned. You definitely seem to have missed/copied incorrect value for one of the below.
Below details are copied from https://developers.facebook.com/docs/marketing-api/guides/lead-ads/retrieving for quicker understanding
One can read leads or real-time updates by:
Using a Page Access Token, i.e. the Page admin's access token for the page. Page access token also allows you to read ad specific fields
such as ad_id, campaign_id, etc., if you have atleast advertiser level
permissions on the ad account associated with the lead ad.
Using User Access Token belonging to the page admin. To access all of the lead data and the ad level data, the access token should have
manage_pages and ads_management scope.
You can manage user rights with Page roles. In addition, if you need
to allow leads download for user with non-admin role on the page, you
can whitelist it with leadgen_whitelisted_users endpoint.
The other answers are not showing how to actually send a Page Access Token instead of an App Access Token or User Access Token.
require_once "vendor/autoload.php";
$config = ...;
use FacebookAds\Api;
use FacebookAds\Object\Page;
use FacebookAds\Session;
$api = Api::init(
$config['facebook']['app_id'], //APP_ID
$config['facebook']['app_secret'], //APP SECRET
$config['facebook']['app_access_token'] //Token generated by https://developers.facebook.com/tools/explorer for app
);
$page_api = $api->getCopyWithSession(new Session(
$config['facebook']['app_id'], //APP_ID
$config['facebook']['app_secret'], //APP SECRET
$page_access_token // <-- You can get this by accessing 'me/accounts' w/ the initial API
));
$page = new Page($config['facebook']['page_id'], null, $page_api); // <-- use the api with the Page Access Token here
$leadgen_forms = $page->getLeadgenForms(); //heres an error

facebook php sdk - Error #200 when trying to use setExtendedAccessToken

I have been trying for several days now to successfully post to a client's Facebook Page wall from their website. I need to be able to do this without having a user logged in, which I was able to achieve with an extended access token generated by going to the URL provided in the docs.
What I am trying to do is to fetch an extended token using the PHP SDK as in this question - Facebook PHP SDK: getting "long-lived" access token now that "offline_access" is deprecated, however I receive the following error:
(#200) The user hasn't authorized the application to perform this action
The debug of the auth token generated by the Graph API Explorer shows myself as the User and includes the needed manage_pages and status_update scopes. However, if I run me/accounts, the perms array does not list these under the data for the page in question - not sure if this is relevant.
Here is the code that I have attempted to use:
$facebook = new Facebook(array('appId' => 'xxxxxxx', 'secret' => 'xxxxxx'));
$pageID = 'xxxxxxxx';
$facebook->setExtendedAccessToken();
$accessToken = $facebook->getAccessToken();
try {
$page_info = $facebook->api("/$pageID?fields=access_token");
print_r ($page_info);
} catch (FacebookApiException $e) {
echo $e->getMessage();
}
if( !empty($accessToken) ) {
$args = array(
'access_token' => $accessToken,
'message' => "Catch phrase!"
);
$facebook->api("/$pageID/feed","post",$args);
} else {
// Handle error
}
UPDATE
I found that if I echoed the output of getAccessToken() the result was the app ID and the secret separated by an | - is this what I should be receiving? Seems odd to me since all of the other tokens I have seen are random and much longer.
ANY help at all would be appreciated, I have wasted so much time on this so far. It just seems to work for everyone else.
UPDATE 2
Hi Warren! Looks like you're new around these parts, welcome! Thanks for your research into this, do I need to save these tokens into a DB table and check to see if they are expired every time I try to post? I am ONLY posting to a Page as the Page, apparently this requires the Page access_token rather than what I am assuming is the USER access_token. I believe I also read somewhere that the Page access token never expires, although it changes if I refresh the Graph API Explorer page or request a new user token. Very puzzling.. do not know if I even need to deal with getting new tokens in this app or just use a Page access_token that appears to work?
Also just looking at the base_facebook.php file and the following function:
/**
* Returns the access token that should be used for logged out
* users when no authorization code is available.
*
* #return string The application access token, useful for gathering
* public information about users and applications.
*/
protected function getApplicationAccessToken() {
return $this->appId.'|'.$this->appSecret;
}
Shows what you are experiencing the function setExtendedAccessToken() calls getAccessToken() which calls the function above to do the following inside setExtendedAccessToken:
$access_token_response = $this->_oauthRequest(
$this->getUrl('graph', '/oauth/access_token'),
$params = array(
'client_id' => $this->getAppId(),
'client_secret' => $this->getAppSecret(),
'grant_type' => 'fb_exchange_token',
'fb_exchange_token' => $this->getAccessToken(),
)
);
the return of this function is then {"error":{"message":"No user access token specified","type":"OAuthException","code":1}} but because there is no access_token the function just returns false
the fb_exchange_token can not be the app id and app secret combined.
I have done some testing and what I have found out is if you get the user to login, you can get there access token. If you pass this token into setAccessToken then run setExtendedToken. If you then save the toke by running getAccessToken you can use this token later when the user is logged out.
$facebook->setAccessToken($facebook->getAccessToken());
$facebook->setExtendedAccessToken();
$access_token = $facebook->getAccessToken(); // save this for later use
You need to get the user to login to ask them for permission to get access to there account. If you need to get access to a facebook page make sure they are an admin and ask for the manage_page permission.
Hope this helps
From what I have found so far the extended token that is returned when the user is logged in does not expire as you do not get back a unix timestamp so you would have no way of knowing when it expires.
This is what I have done in my application.
Request the user to login to facebook and except the access permissions. Use getAccessToken to get the current access token. With this I pass into getExtendedAccessToken then run getAccessToken again to finally get the extended access token which I store in a database for later use.
$facebook = new Facebook(array(
'appId' => 'YOURAPPID',
'secret' => 'YOURSECRET',
));
$params = array(
'scope'=>'publish_stream,manage_pages'
);
$loginUrl = $facebook->getLoginUrl($params); // Use this to request them to login in then when they are do the following you will need them to return to your app
$facebook = new Facebook(array(
'appId' => 'YOURAPPID',
'secret' => 'YOURSECRET',
));
$facebook->setAccessToken($facebook->getAccessToken());
$facebook->setExtendedAccessToken();
$access_token = $facebook->getAccessToken(); // store $access_token for later use

OAuthException: An active access token must be used to query information about the current user

I've this error, but not always. (I use PHP SDK, latest version).
If I'm logged into facebook and i try to register and login, then the app say it's ok!
Also if i'm not logged into facebook, the app redirect me to login url, and here it's all ok.
But sometimes the app say this exception: OAuthException: An active access token must be used to query information about the current user. and the script redirect the user to loginUrl with a loop-redirect (because the access token isn't valid and user need always of loginUrl)
In the web some say that Facebook create a duplicate of Access Token and then access token of php sdk don't is = facebook.
For fix, the user must deletes cookies, how I can fix this?
Thanks a lot for reply, if code is need reply and I'll post it, have a good day! :)
Try to destroy the Facebook session, then redirect the user to login URI if you receive this error, this way you will get a fresh access token.
Notice: Access token expire after a very short, you can get a long living access token. The latest PHP SDK contains a public function called : setExtendedAccessToken()
you can call this function to automatically exchange the 2-3 hours living access token for a 60 days access token
Eg:
try {
$user = $this->facebooknew->api('/me');
$this->facebooknew->setExtendedAccessToken();
$access_token = $this->facebooknew->getAccessToken();
}
catch(FacebookApiException $e){
$this->facebooknew->destroySession();
header('Location: ' . $this->facebooknew->getLoginUrl($params));
//echo $e;
}

Post to Facebook Page Wall without logged in user

I have a Facebook app that I want to use to post on my customer's Facebook Page Walls on their behalf. I have it setup now so that when they authenticate my app I get the Access token, but when I go to post to the wall I am getting the following error: "OAuthException: Error validating access token: The session is invalid because the user logged out."
How can I post from my script without being logged in?
Here is my code:
include_once('fb-php-sdk/src/facebook.php');
$facebook = new Facebook(array(
'appId' => 'XXX',
'secret' => 'XXX',
));
try {
$page_id = '215133535279290'; //page id of the customer's facebook page
$args = array(
'access_token' => 'XXX', //access token received when user authenticated app
'message' => 'A test message'
);
$post_id = $facebook->api("/$page_id/feed","post",$args);
} catch (FacebookApiException $e) {
echo "Error:" . $e;
}
The new facebook API has what is called an extended access token (it replaces offline access: https://developers.facebook.com/roadmap/offline-access-removal/ I think) which I believe lasts upto 60 days (or something like that). To use it simply get the access token when the logs in through your website:
$token = $facebook->getAccessToken();
Save it to Db and use this token later:
$facebook = new Facebook();
$facebook->setAccessToken($accessTokenFromDB);
Then you should be able to continue as though the user is logged in.
As for the user being logged out part, make sure you are using the latest version of the API and not an old version and also make sure the stuff under the "Scenario 2: If you have been previously requesting offline_access - updated 4/30/2012" heading of the page I linked.
You could carry on using offline_access until 3rd of October, but then why if it's being turned off for real in 2 months time and would have to rewrite your code.
Get the publish_stream extended permission. Once you have this permission you can post feed stories using your app access token while the user is offline. There is no need for offline_access permissions or saving and using a user access token in this scenario.

Facebook Graph API session expiration

I use the following PHP code to publish random messages from my database to my Facebook fan page:
require_once('src/facebook.php');
$appid = 'MY_APP_ID';
$appsecret = 'APP_SECRET';
$pageid = 'MY_PAGE_ID';
$token = 'MY_ACCESS_TOKEN';
// Create our Application instance (replace this with your appId and secret).
$facebook = new Facebook(array(
'appId' => $appid,
'secret' => $appsecret,
));
$message = 'Hello World';
//Information that makes up the facebook page post
$attachment = array(
'access_token' => $token,
'message' => $message
);
//Try to post to the facebook page
try{
$res = $facebook->api('/'.$pageid.'/feed','POST',$attachment);
} catch (Exception $e){
echo $e->getMessage();
}
And here is src/facebook.php - https://github.com/facebook/facebook-php-sdk/blob/master/src/facebook.php
But it return the error message something like this:
Error validating access token: Session has expired at unix time 1339020000. The current unix time is 1339022625.
So my question is what changes should I do in my code ?
P.S: I also looked relevant questions about session expiration, but none of them helped me.
Thanks in advance.
I'm assuming that you are using your user access token and not a page access token in this case.
You should be authenticating against the application with the manage_pages permission which will give you access to retrieve access tokens for your page. These have a longer expiration period.
After authorizing this permission and retrieving a valid access token for the current user, you should make a request to the following endpoint to retrieve a list of pages and applications you manage:
https://graph.facebook.com/me/accounts?access_token=USER_ACCESS_TOKEN
In this response is included an access token for these pages and applications:
{
"data": [
{
"name": "PAGE_TITLE",
"access_token": "PAGE_ACCESS_TOKEN",
"category": "PAGE_CATEGORY",
"id": "PAGE_ID"
},
You can see more information about this here:
https://developers.facebook.com/docs/authentication/pages/
Updated
For expired access token you will need to reauthenticate your user by accessing your app via a browser and following the authentication flow.
The documentation on how to handle this is here:
http://developers.facebook.com/docs/authentication/access-token-expiration/
You can then request a longer lived access token these do still expire. You can see information about how to request one of these here under scenario 4:
http://developers.facebook.com/roadmap/offline-access-removal/

Categories