Question

I want to authenticate native devise by oauth2 access token, which was obtained using client side flow (http://developers.facebook.com/docs/authentication/)

Currently I just call one of the protected method using this token and handle AccessDenied error. May be there is build in method that validates token?

Here is ruby sample with OAuth2 gem:

begin
  response =  JSON.parse(token.get('/me'))
rescue OAuth2::AccessDenied
  render :json => { errors: {"" => ["Invalid oauth2 token"]}}
else
  ...
end

Answer 1

If I understand your question, you’re asking how to handle when a valid access token becomes invalid, for example, if a user removes your app. According to this Facebook blog post: https://developers.facebook.com/blog/post/500/, there is no absolute way except for firing an API call, which you surmised. Guess we are all out of luck.

P.S. That blog post has good details on other scenarios a valid access token might expire.