Home/ Questions/Q 6597193
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T18:10:40+00:00

I am integrating Facebook authentication, registration and app requests with our web app, using

  • 0

I am integrating Facebook authentication, registration and app requests with our web app, using a combination of the the Javascript SDK (to manage FB buttons, dialogs, client-side API, etc) and the PHP SDK to process signed requests, auto-login facebook-connected users and use the API to process app requests. I have most things working well and the overall workflow is acceptable.

My question is specifically regarding the “email” extended permission and whether I need it to guarantee that the signed request returned during by the registration plugin will contain the user’s email.

I am aware of the current limitations of the registration plugin (in that you cannot ask for extended permissions), but I need the email of the Facebook user when they register. This is so that the user can login both with their FB credentials and standard email/password as per non-FB connected users. (Please don’t just suggest that I change the registration process to allow users to register without email – this is a hard requirement for several good reasons that I won’t go into here).

At the moment, I am attempting to to “shield” the Facebook registration with a login process to force the user to provide the “email” permission before registering. However this is clunky if placed as a pre-step to FB registration, and/or difficult to guarantee that the user will have passed through this step before reaching the FB registration form.

Does anyone know for certain whether the “email” extended permission is actually required to guarantee getting the user’s email during the reigstraion? I cannot find any settings in Facebook (for my test users) that would seem to prevent apps getting the email. Does the fact that I have included the email field in the registration form guarantee that I will get it back in the signed request?

Please note that at the moment, we have no other requirements for extended permissions, and as we need them, we plan to ask the user at the point of need.

Any help/confirmation would be appreciated – I have searched, but cannot find the answer to this exact point (although I could of course have missed it!).

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You shouldn’t need your users to authorise the app before using the registration plugin, the registration plugin exists specifically to avoid apps having to build in their own system for having users authorise an app before their data can be used to prefill a form.

    If you use the registration plugin with fb_only specified, and request the email field, you’ll receive the user’s email address in the signed request callback when they register.

    If you allow users to register using the plugin, but without requiring them to use their Facebook data, the email field could contain whatever email address they’ve entered manually.

    The full documentation is at https://developers.facebook.com/docs/plugins/registration/

    • 0