I’ve been researching this topic and can’t find anything for the Javascript SDK. I’ve found the examples for PHP and C# but I’m still unsure about the Javascript SDK. From what I can tell, you setup a page that has the JS SDK on it, put that in the deauthorize callback URL and subscribe to the authResponseChange event on that page.
That’s the best I can tell, but I haven’t found any examples or confirmation if this approach works. If any examples can be provided that would be wonderful.
I did test this on the Javascript Test Console: http://developers.facebook.com/tools/console/ but that method uses revoke authorization from the old rest API. We want to use the deauthorize Callback URL to remove the Facebook association from the user account.
You should handle it on the server. The Deauthorize callback comes as a form POST to your url, with a form parameter of signed_request containing a signed request value. You will need to parse the signed request value using your app secret to get the userid of the user who removed your app. Then you can update your app’s database or do whatever is appropriate when a user removes your app.
You don’t want to do this client side in javascript due to the need to use your app secret to parse/decrypt the signed_request value.