I am obtaining access token for Facebook entegration on my web page. Is it OK to share this one with the client? I want to perform some tasks on client’s browser.
The token I am referring to is the one that is got with
https://graph.facebook.com/oauth/access_token?
URL.
Each access token is generated on a per user basis. Only the user that was given that access token (by facebook) will be authorized to perform actions with it. There shouldn’t be a problem making this access token available to the user.
I cant see a reason why you would have to share it with the client thou. If you use the facebook JavaScript SDK, and go through the login flow you’ll be able to make calls to the API from the clients browser.
One parameter that you should never share with the client is your
APP_SECRET.