Question

I’m trying to POST a new open graph action to Facebook, but I can’t seem to get the right access_token. I’ve tried both an app and a user token. Each time the error tells me to use the other.

I’m actually using django_facebook, but for this example, I’ll just talk in raw http. (BTW, these app ids/secrets are all bogus no need to redact.)

For this example, I have a properly working open graph object called a “promotion”, and I ran the debugger on it, it’s all good. It works from a site like this: http://mysite.com/promotion/66306/ Then I have a new open graph action type (for sake of example) called myaction which I’ve registered with Facebook.

Here’s what I’ve tried…

Step 1: Get an App Access Token

https://graph.facebook.com/oauth/access_token?client_id=1111111111&client_secret=my11app22secret&grant_type=client_credentials

returns this:

access_token=1111111111|someapptoken

Step 2: Get a user Token

by going here: https://developers.facebook.com/tools/explorer/
chose my app, get access token, with the permission publish_actions

Access Token:someLongUserToken

Step 3: Try with the user token

curl -X POST -F 'promotion=http://mysite.com/promotion/66306/' -F 'access_token=someLongUserToken' https://graph.facebook.com/me/myapp:myaction
{"error":{"message":"(#15) This method must be called with an app access_token.","type":"OAuthException","code":15}}

Step 4: Try with the app token

curl -X POST -F 'promotion=http://mysite.com/promotion/66306/' -F 'access_token=1111111111|someapptoken' https://graph.facebook.com/me/myapp:myaction
{"error":{"message":"An active access token must be used to query information about the current user.","type":"OAuthException","code":2500}}

Now a big clue may be that I haven’t yet gotten “approval” for my action type, however I’m an admin on the app, so it should work, no?

Approval Status:
Unsubmitted
This Action Type must be submitted for review in order for it to be available to all users. This Action Type is available to admins and developers of the app.

What am I missing?

Thanks!
-Jeff

Answer 1

Check the settings for the action – there’s an option you can enable which requires that publishes can only be made with the app access token – if you enabled that then the #15 message is correct.

You also can’t use the app access token with the /me shortcut, because ‘me’ refers to the currently-logged-in user whose access token you’re using – if you’re using an app access you need to specify the user ID in the path instead of using /me/