How do I get a page Access Token that does not expire? - facebook-graph-api

Question

I would like to know if it is possible to have an access token that never expires for post to my page
Now I get the access token with:
https://graph.facebook.com/me/accounts
I have publish_stream and manage_pages permission, but using the Access Token Debugger I see that the token expires in about 1 hour. Is there a way to never expires?

Answer 1

See facebook developers:
By using a long-lived user access token, querying the [User
ID]/accounts endpoint will now provide page access tokens that do not
expire for pages that a user manages.
So, you have to exchange your initial shortlived token for a longlived token with a server side call:
https://graph.facebook.com/oauth/access_token?
client_id=APP_ID& client_secret=APP_SECRET& grant_type=fb_exchange_token& fb_exchange_token=EXISTING_ACCESS_TOKEN
And then query me/accounts with that longlived token. Definitly works for us, i.e. the debugger shows: 'Expires: Never'
edit - our process
So, what we do is:
first client side authentication with our app where we get a "code" back after the user accepts the requested permissions and connects his account with our app
https://www.facebook.com/dialog/oauth?
client_id=YOUR_APP_ID &redirect_uri=YOUR_REDIRECT_URI &scope=COMMA_SEPARATED_LIST_OF_PERMISSION_NAMES &response_type=code
Now in our server application we use server side authentication to exchange code for access token:
https://graph.facebook.com/oauth/access_token?
client_id=YOUR_APP_ID &redirect_uri=YOUR_REDIRECT_URI &client_secret=YOUR_APP_SECRET &code=CODE_GENERATED_BY_FACEBOOK
With this access_token we do the server side exchange as described above
Now we request me/accounts and the resulting access_token is always valid
Hope that helps

Answer 2

I've simplified Pete's answer a bit and added the step to get a non-expiring page access token:
access the following URL and note the returned access token within the browser's address bar:
https://www.facebook.com/dialog/oauth?client_id=APP_ID&redirect_uri=REDIRECT_URI&scope=manage_pages,publish_stream&response_type=token
access the following URL and within the returned data find the desired page's name and note the access token:
https://graph.facebook.com/me/accounts?access_token=ACCESS_TOKEN_RETURNED_FROM_STEP_1
access the following URL and note the returned access token:
https://graph.facebook.com/oauth/access_token?client_id=APP_ID&client_secret=APP_SECRET&grant_type=fb_exchange_token&fb_exchange_token=PAGES_ACCESS_TOKEN_FROM_STEP_2
use the Access Token Debugger to ensure your access token's profile ID matches the desired page's ID and it never expires

Answer 3

There is a MUCH easier way to do this as of 2016 :)
Go to https://developers.facebook.com/tools/explorer
Select your app from the dropdown on the top right hand
side
Click “Get Access Token” button just below the application dropdown
on the right hand side
In the dropdown select the page you want to get a access token for.
If you don’t see your pages listed then you’ll need to make sure
you’re set with the admin role for the page. Also you may have to
click “Get Page Access Token” in the dropdown, after which then your
pages will show in the dropdown next time you click the “Get Access
Token” button.
Click the blue exclamation point icon in the “Access token” input field
Click the “Open in Access Token Tool” button on the
bottom right of the popup
Click the “Extend Access Token” button to get an token that never
expires
Original info from this article: https://www.rocketmarketinginc.com/blog/get-never-expiring-facebook-page-access-token/

Answer 4

Ok so it took about a week of research but here is my solution.
in the https://developers.facebook.com/tools/explorer/ make sure that you have manage_page as part of your access_token. after that use this code with your app id, secret, and redirect:
<?php
app_id = "APP_ID";
$app_secret = "APP_SECERET";
$post_login_url = "REDIRECT_URL";
$code = $_REQUEST['code'];
//Obtain the access_token with publish_stream permission
if(empty($code)){
$dialog_url= "http://www.facebook.com/dialog/oauth?"
. "client_id=" . $app_id
. "&redirect_uri=" . urlencode( $post_login_url)
. "&COMMA_SEPARATED_LIST_OF_PERMISSION_NAMES";
echo("<script>top.location.href='" . $dialog_url
. "'</script>");
}
else {
$token_url="https://graph.facebook.com/oauth/access_token?"
. "client_id=" . $app_id
. "&redirect_uri=". urlencode($post_login_url)
. "&client_secret=" . $app_secret
. "&code=" . $code;
$response = file_get_contents($token_url);
$params = null;
parse_str($response, $params);
$access_token = $params['access_token'];
echo 'access token: ' . $access_token.'<br>';
if($access_token){
$token_url="https://graph.facebook.com/oauth/access_token?"
. "client_id=" . $app_id
. "&redirect_uri=". urlencode($post_login_url)
. "&client_secret=" . $app_secret
.'&grant_type=fb_exchange_token'
. "&fb_exchange_token=" . $access_token;
$response = file_get_contents($token_url);
$access_token = $params['access_token'];
echo 'new access token: '.$access_token;
}
}*/
?>
After that copy the 'new access token' and go back to https://developers.facebook.com/tools/explorer/ When you get there past in your new access token into the the access token field.
Then click submit. After that in the node you will see a +____ click on this and scroll down to the accounts and click that. find the page that you need the access token for and copy and paste it into the access key field. click debug and you will see that it will never expire. save that token it will stay valid as long as you do not reset your apps secret.

Answer 5

You can use following api from facebook to refresh token life to 60 days and just when the token is about to expire, call the same api again with-in 60 days to refresh its life back to 60 days from that point of time
Token expire is present in expires parameter and its value is in seconds
Replace CLIENT_ID and CLIENT_SECRET with their actual value
https://graph.facebook.com/oauth/access_token?client_id=&client_secret=&grant_type=fb_exchange_token&fb_exchange_token=
in ACCESS_TOKEN, put the actual token value without appending "access_token="