I’m getting started with the realtime Facebook stuff, and have hit a newbie-type snag. I want to receive notifications when users of my app add or remove a friend. I get the overall architecture: I set up a subscription to the “user” object and the “friends” field, and, once all the verification has happened, when one of my app’s users changes his friends, my callback url will get sent a JSON string giving me the user id of the user whose friends have changed. Cool.
I’m then supposed to make a call up to Facebook to get the (new) friends of this user, and do whatever it is I’m going to do with them. There’s my question: how do I get an access token that will let me see that user’s friends? I’ve been experimenting with Graph API Explorer, and I keep getting told that, when I try to see the friends of USER_ID, that I “…can’t lookup all friends of USER_ID. Can only lookup for the logged in user (USER_ID), or friends of the logged in user with the appropriate permission.” But if I can’t do that, what’s the point of getting the notification that a user has a new set of friends? Especially since the Facebook docs make a big point about how you can get realtime notifications of changes in your users’ friends? Or is this something that will magically start to work after I have the subscription set up?
Like I said, this is probably a newbie-hasnt-figured-out-the-big-picture thing; there’s something I’ve just missed. But clarifications to get me past this would be greatly appreciated — thanks!
Solved, it would seem. The story, in case someone else finds this thread, is that you CAN get the friends of a user of your app, by using an APPLICATION access token build from your app’s id and app secret. Your users have given your application permission to see their friends, so everything works the way it should. The problem with using (or trying to use) Graph API Explorer for this is that the access token its button creates is a USER access token, which indeed cannot be used to see the friends of someone other than yourself. Anyway, get an use an application access token, andall should be well.
(BTW, in case someone sees that I have this wrong and have stumbled into something incorrect that happens to work out of chance, a comment would be appreciated…)