Question

I am working on facebook application. I am getting the offline access permission from my app user. Now I want that I can use the same tokens that generated one time when user uses first time my app and i will store this token in my db and whenever the user will login again on our site and want to publish some wall post through our app we will use the same token for publishing on wall.

Here is my code

protected void Page_Load(object sender, EventArgs e)
{
    var auth = new CanvasAuthorizer { Permissions = new[] { "user_about_me", "publish_stream", "video_upload", "share_item", "photo_upload", "offline_access" } };

    var fbWebContext = FacebookWebContext.Current;
    if (fbWebContext.IsAuthorized())
    {
        try
        {
            var fb = new FacebookWebClient(fbWebContext);
            var token = fb.AccessToken;  \\ Im Getting Token This Way When its Generated From User After Getting Extended Permission
            dynamic result = fb.Get("/me");
            long id = fbWebContext.UserId;
        }
        catch (Exception ex)
        {
            if ("(OAuthException) Error validating access token: The session is invalid because the user logged out or because auth.expireSession was invoked." == ex.Message)
            {
                fbWebContext.DeleteAuthCookie();
                Session.Clear();
            }
        }
    }
}

I get the access token using var token = fb.AccessToken but when I use it it says

Your Token is Expired at Unix Time xxxxxxxxxx.

Can anyone please tell me anyone if this is the access token after requesting the extended permission of offline access then why is it saying “Your Access token is Expired?”. Can anyone please help?

Answer 1

The main issue here is that even though you request the offline_access permission, you can’t be 100% sure the token will never exipre.

There are a number of cases where the Access Token may expire – even with the offline_access – scenarios such as: user changes password, app secret changes etc. In these and other cases, your app must be able to detect the invalidated access token and pass the user through the auth flow to get a new, fresh token.

You can test your access tokens, and get debug on them by using the access token and access token lint tools: https://developers.facebook.com/tools/access_token and https://developers.facebook.com/tools/access_token/lint

To double check you’ve successfully got a valid token, copy and paste one you got via the API into the graph explorer tool. https://developers.facebook.com/tools/explorer/?method=GET&path=me