Facebook offline access step-by-step

Question

UPDATE: Facebook offline_access permission is being deprecated. Please refer to the official documentation for more information.
You'll have till May 1, 2012, at which date this setting will be disabled. refer to the Developer Roadmap for more info.

---

After searching literally 1 day on facebook and google for an up-to-date and working way to do something seemingly simple:

I am looking for a step-by-step explanation to get offline_access for a user for a facebook app and then using this (session key) to retrieve offline & not within a browser friends & profile data.

Preferrably doing this in the Fb Java API.

Thanks.

And yes I did check the facebook wiki.

Update: Anyone?

this: http://www.facebook.com/authorize.php?api_key=<api-key>&v=1.0&ext_perm=offline_access gives me offline_Access, however how to retrieve the session_key?

Why can't facebook just do simple documentation, I mean there are like 600 people working there?

The seemingly same question: Getting offline_access to work with Facebook Does not answer how to retrieve the session key

Edit: I am still stuck with that. I guess nobody really tried such a batch access out yet...

Answer 1

With the new Facebook Graph API, things got a bit simpler but far less well documented. Here's what I did to be able to load my wall posts as me from a server side only (not part of a browser session) php script:

1. create a facebook application, if you don't already have one usable for this project http://www.facebook.com/developers/apps.php#!/developers/createapp.php -- and set sandbox/developer mode on! @ Advanced Settings > Sandbox Mode > Enable (Lets only the developers of your application see it.) You'll need the Application ID (APP_ID) and Secret Key (SECRET_KEY) that are listed on your developer account summary of that application but not the old API Key.

2. load in your browser, already logged in to fb as the account you want your server side app to connect as, and click "allow" for the requested permissions: https://graph.facebook.com/oauth/authorize?client_id=APP_ID&scope=offline_access,read_stream&redirect_uri=http://www.facebook.com/connect/login_success.html

3. copy the "code" parameter from the resulting url's query string, use that in: https://graph.facebook.com/oauth/access_token?client_id=APP_ID&redirect_uri=http://www.facebook.com/connect/login_success.html&client_secret=APP_SECRET&code=CODE_FROM_2 And copy the right hand side of access_token= in the resulting page's text, which will be in the structure of: APP_ID|HEXNUM-USER_ID|WEIRD_KEY

4. now download either from the graph api or the classic rest api using the oath access token you just got ala (where SOURCE_ID is the facebook id for the user/group/whatever that you are looking up):

   <?php
   $stream = json_decode(file_get_contents("https://api.facebook.com/method/stream.get?source_ids=SOURCE_ID&access_token=ACCESS_TOKEN&format=json"));
   var_dump($stream);
   // this one gives a 500 internal server error from the http get if any of the fields are invalid, but only in php, not when loaded in a browser... weird.
   $feed = json_decode(file_get_contents("https://graph.facebook.com/SOURCE_ID/feed?fields=id,from,created_time,link,type&access_token=ACCESS_TOKEN"));
   var_dump($feed);
   ?>
   

Noting that the graph api and rest api return not just different structures, but also different information -- so here, I prefer the results from the rest api (the first one) even though I like being able to restrict the fields in the new graph api (the second one).

Look at http://developers.facebook.com/docs/authentication/ in the sections "Requesting Extended Permissions" and "Authenticating Users in a Web Application" for the official (sparse) details.

If you want to do this routinely, i.e. programmatically, here's the automated version of steps 2+3:

Put this on your web server as "facebook_access_token.php":

<?php $token = explode('=', file_get_contents("https://graph.facebook.com/oauth/access_token?client_id=APP_ID&redirect_uri=http://$_SERVER[SERVER_NAME]$_SERVER[PHP_SELF]&client_secret=APP_SECRET&code=" . 
(get_magic_quotes_gpc() ? stripslashes($_GET['code']) : $_GET['code']))); 
echo $token[1]; 
// store this, the access token, in the db for the user as logged in on your site -- and don't abuse their trust! ?>

And direct users in their browsers to: https://graph.facebook.com/oauth/authorize?client_id=APP_ID&scope=offline_access,read_stream&redirect_uri=http://www.example.com/facebook_access_token.php

Answer 2

If you want finally want to use PHP, with the Facebook PHP SDK v3 (see on github), it is pretty simple. To log someone with the offline_access permission, you ask it when your generate the login URL. Here is how you do that.

Get the offline access token

First you check if the user is logged in or not :

require "facebook.php";
$facebook = new Facebook(array(
    'appId'  => YOUR_APP_ID,
    'secret' => YOUR_APP_SECRET,
));

$user = $facebook->getUser();

if ($user) {
  try {
    $user_profile = $facebook->api('/me');
  } catch (FacebookApiException $e) {
    $user = null;
  }
}

If he is not, you generate the "Login with Facebook" URL asking for the offline_access permission :

if (!$user) {
    $args['scope'] = 'offline_access';
    $loginUrl = $facebook->getLoginUrl($args);
}

And then display the link in your template :

<?php if (!$user): ?>
    <a href="<?php echo $loginUrl ?>">Login with Facebook</a>
<?php endif ?>

Then you can retrieve the offline access token and store it. To get it, call :

if ($user) {
    $token = $facebook->getAccessToken();
    // store token
}

Use the offline access token

To use the offline access token when the user is not logged in :

require "facebook.php";
$facebook = new Facebook(array(
    'appId'  => YOUR_APP_ID,
    'secret' => YOUR_APP_SECRET,
));

$facebook->setAccessToken("...");

And now you can make API calls for this user :

$user_profile = $facebook->api('/me');

Hope that helps !

Answer 3

I did a tutorial not too long ago on my blog. It doesn't require any plugins or whatnot, it is done in PHP, and I have tested it. I did it for mainly wall posts, but after you authenticate you can use whatever function you want.

EDIT: Post no longer exists. FB API is updated anyway...

Answer 4

You want to start by reading the Server Side Flow section in the authentication guide. Basically, start with this URL:

https://www.facebook.com/dialog/oauth

Add your application id (available here) to the URL, which in OAuth parlance is client_id:

https://www.facebook.com/dialog/oauth?client_id=184484190795

Add the offline_access permission or scope in OAuth parlance:

https://www.facebook.com/dialog/oauth?client_id=184484190795&scope=offline_access

Add a redirect_uri which is where Facebook will redirect to after the user completes the authorization step ("Allow" or "Dont Allow", look at docs for response format or just try it out):

https://www.facebook.com/dialog/oauth?client_id=184484190795&scope=offline_access&redirect_uri=https%3A%2F%2Ffbrell.com%2Fecho

If you follow the link above, it will take you to a prompt, and then upon clicking Allow/Dont Allow it'll take you to a page that "echos" back the request. If you click Allow, you'll get a code parameter back, which you can exchange for an access_token by making an HTTP request to Facebook from your server, which does something along the lines of this:

https://graph.facebook.com/oauth/access_token?client_id=184484190795&client_secret=XXX&code=YYY&redirect_uri=ZZZ

You need to pass in your client_id, your application secret must be passed in as the client_secret, the same redirect_uri as you used earlier and the code you received as the response. This will return the offline_access enabled access_token for that user.

One thing to keep in mind though is that even if you request offline_access your application must gracefully handle invalid or expired access_tokens, as that can happen for various reasons.

Answer 5

I know two solutions: Java and JavaScript

Java : a. servlet code (don't forget to import relevant jar's) :

String url="http://www.facebook.com/login.php?api_key=YOUR_API_KEY&v=1.0";
url+="&fbconnect=true&return_session=true&req_perms=offline_access,status_update";
url+="&next=http://YOUR_FaceBookCallback_SERVLET"; 
response.sendRedirect(url);
return;

//You will get prompt to log in to facebook and permit the extended permissions

b. Don't forget to define your ConnectUrl(in your facebook account application) as http://YourUrlFromWhereDoYouTurnToTheServletAbove

c. make another servlet : YOUR_FaceBookCallback_SERVLET (see above) with this code:

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
String session = request.getParameter("session");
//from this string you can obtain your infinite session_key.In order to do this, parse this string as JSON.
//Save it in the database or in the other data storage  
response.sendRedirect(ThePlaceThatYouWant);}

d. Use this secret session_key like this:

FacebookXmlRestClient  client = new FacebookXmlRestClient(YOUR_API_KEY, FACEBOOK_APPLICATION_SECRET,SECRET_SESSION_KEY);
client.setIsDesktop(false); 
client.users_setStatus("YourMessage");

If anybody wants the JavaScript solution(the big hole in security) write me

Answer 6

I figured out how to "retrieve" the offline access infinite session key after a lot of hair-splitting, some trial and error & wondering about all the other productive ways I could have spent that time... agree facebook documentation could be a lot better

1) If you are using the facebook-java-api.. then take a look at the facebook demo site for "mobile web" on how to format the URL for requesting offline access
http://itsti.me/index.php

<a href="http://www.facebook.com/connect/prompt_permissions.php?api_key=YOUR_API_KEY&ext_perm=publish_stream%2Coffline_access&next=http%3A%2F%2Fmysite%2Ffacebookconnect&cancel=http%3A%2F%2Fmysite%2Fhome&display=wap"><img alt="Connect" src="http://static.ak.fbcdn.net/images/fbconnect/login-buttons/connect_light_medium_long.gif" id="fb_login_image"/></a>

2) As to how get the offline session key from the session..The trick is : when facebook redirects the user to the "next" url right after granting offline access, you should get the facebook session "again"..this new session will have the infinite session key.
here is an example for mobile web...you should be able to figure it out for a regular website.The auth_token is used only for mobile web sites.. you may not need it for a regular web site

FacebookJsonRestClient fbc = new FacebookJsonRestClient(MY_API_KEY, SECRET, sessionKey);
String auth_token = request.getParameter("auth_token");
System.out.println("infinite session kEY = " +   fbc.auth_getSession(auth_token));

Answer 7

For session access, i had to use the loginurl provided by the facebook php api, as there seem to be 2/3 additional variables that it sends in the auth request, including return_session and session_version. Also the new php5-sdk sends the request to login.facebook.com instead of https://graph.facebook.com/oauth/authorize. Here's how i worked it out :

$b=new facebook(array('appId'=>APP_ID,'secret'=>SECRET))

To ask for authentication :

$facebook->getLoginUrl(array('next'=>$redirect_uri,'req_perms'=>$scope))

Rember to include offline_access in $scope. Once you are redirected to this page (after logging in to fb, and granting permissions), you will have a $_GET['session'] in json format.

Just store it wherever you want (I do it in a database). The next time you wish to do something with the user's account, just use the following:

$session = json_decode($db->query("SELECT ..."));//get session from db $this->facebook->setSession($session);

After this any requests that the api makes will be via this user's access.

The worst thing about the current facebook graph api is (correct me if I'm wrong) that the current api neglects the session (which seems to be a remain from the old api) in all its documentation and only talks about the access_token. But the current api (php5-sdk) has got no feature to send an actual request using only the access_token. If there is a function to start a session a session using only the access_token, I'm not aware of it.