[FIXED] How to login user from inside Facebook Page Tab and get access_token on server side to post a carousel to the feed?

Issue

I have a Page Tab facebook app. I want to post to users timeline from it.

After login on client side with javascript sdk (I use angularjs module for that Ciul/angular-facebook (sorry, cannot post github link here)):

https://gist.github.com/Sevavietl/7e363fdfd0e714a12a43

I retrieve access_token on server side and trying to post a carousel to the users feed:

https://gist.github.com/Sevavietl/cec5fa434837312adfd3

I have two problems:

1. While first call I get Graph returned an error: (#210) Param id must be a page.

After browsing, I found that this can be caused by wrong token usage. Not user_access_token. But I login the user on the client side.

2. And for next calls I get Graph returned an error: This authorization code has been used.

Again, after browsing, I found that token can be used only once in order to be OAuth compliant.

Please, advise me how to do this right?

Thank you in advance.

Best regards, Vsevolod

Solution

After spending some time on this, I am writing my solution, as it was not really obvious, at least for me. But, actually, all info is present in the documentation.

Starting with problem number 2: And for next calls I get Graph returned an error: This authorization code has been used.

As it was mentioned in the comments, I indeed was confusing access_token with authorization code. As I understand in really simplified form, the mechanism is:

1. When you login with facebook-javascript-sdk it writes authorization code to cookies.

2. Then on the server side you can retrieve access_token from javaScriptHelper available in facebook-php-sdk. This helper has getAccessToken() method, which retrieves access_token using authorization code from cookies. This is the place where I was confused. I was trying to use getAccessToken() on every request. As requests were made with AJAX the authorization code was not changed, and as you can use it only once I was getting an error. The solution to this was pointed in many places on the Internet, but somehow I was able to misunderstand this. Here is the code excerpt that uses sessions to store access_token, and uses getAccessToken() method only if access_token is not set in the session.

       $fb = new Facebook([
           'app_id' => $widget->app_id,
           'app_secret' => $widget->app_secret,
           'default_graph_version' => 'v2.5',
       ]);
   
       $helper = $fb->getJavaScriptHelper();
   
       if ($request->session()->has('facebook_access_token')) {
           $accessToken = $request->session()->get('facebook_access_token');
       } else {
           $accessToken = $helper->getAccessToken();
   
           // OAuth 2.0 client handler
           $oAuth2Client = $fb->getOAuth2Client();
   
           // Exchanges a short-lived access token for a long-lived one
           $longLivedAccessToken = $oAuth2Client->getLongLivedAccessToken($accessToken);
           $request->session()->put('facebook_access_token', (string) $longLivedAccessToken);
           $request->session()->save();
       }
   
       if ($accessToken) {
           $fb->setDefaultAccessToken($accessToken);
       } else {
           die('No Access Token');
       }
   

I use Laravel, so the session handling is not framework agnostic. This code is only for example, it is better to create service and move logic there.

Now. About the first problem: While first call I get Graph returned an error: (#210) Param id must be a page.

Again I was confusing two things '{user-id}/feed' and '{page-id}/feed'. My aim was to post a carousel with images and links. To create a carousel you have to provide child_attachments in the fields array. While you can send a Post like this to '{page-id}/feed', you cannot do so for '{user-id}/feed'. So at the moment you cannot post a carousel to users feed. So when Graph Api was getting a Post data applicable for '{page-id}/feed', it was assuming that I have passed the {page-id}. And when getting the {user-id} instead, the Graph Api yelled back "(#210) Param id must be a page.".

Answered By - sevavietl