why do I get "Invalid appsecret_proof provided in the API argument"

Question

Since the latest change on Facebook, regarding the appsecret_proof: https://developers.facebook.com/docs/reference/api/securing-graph-api/, we are still unable to download performance reports even after enabling/disabling features from Advanced Settings in our app, or apply the code as described in their document.

We are constantly getting this error:

{"error":{"message":"Invalid appsecret_proof provided in the API argument","type":"GraphMethodException","code":100}}

and I've open a confidential bug but no one returns to me with an answer.

I really don't know what more could we try?

score 58 · Accepted Answer · answered Sep 09 '13 at 02:41

58

The error is (based on my experience) almost certainly correct; it means you're proving an invalid appsecret_proof with your API call

Assuming you're using the standard PHP SDK without modifications, the most likely reasons for this are:

You configured the wrong app ID in the SDK code
You configured the wrong app secret in the SDK code
You're trying to use an access token from the wrong / another app

answered Sep 09 '13 at 02:41

Igy

43,710
8
89
115

hi Igy, thanks for your respond, we will check this as soon as we can, but also - this is how we generate the appsecret, can you see if it's correct? `code`string appSecret = Instance.Configuration.Options[FacebookConfigurationOptions.AppSecret]; var secretByte = Encoding.UTF8.GetBytes(appSecret); var hmacsha256 = new HMACSHA256(secretByte); var tokenBytes = Encoding.UTF8.GetBytes(_accessToken); hmacsha256.ComputeHash(tokenBytes); return ByteToString(hmacsha256.Hash); `code` – user1508682 Sep 09 '13 at 12:36

score 19 · Answer 2 · answered Mar 28 '16 at 22:32

Another potential cause of the "Invalid appsecret_proof ..." error, is a user access token that is not associated with an app. If you are generating a user access token using the graph explorer, make sure to select an app from the dropdown on the top right corner. Otherwise, you will be generating tokens that only work within the graph API explorer.

I filed a bug with the Python SDK before I caught my mistake. GUIs are the devil.

Thats it! In my case that helpd! – unbreak Mar 14 '18 at 08:45 — unbreak, Mar 14 '18 at 08:45

score 12 · Answer 3 · edited Aug 13 '14 at 10:18

12

No bug in the latest version of the facebook PHP SDK. You need to create appsecret_proof as per the docs:

$appsecret_proof= hash_hmac('sha256', $access_token, $app_secret);

then pass it as a parameter to your api call.

See the docs here: https://developers.facebook.com/docs/graph-api/securing-requests/

Once I did this all was good and I didn't have to hack base_facebook.php

edited Aug 13 '14 at 10:18

Gowri

16,587
26
100
160

answered Jan 29 '14 at 10:46

user3077584

129
1
2

3

The hashing is already done in the base_facebook.php on line 919 why do it again ? – astroanu Apr 11 '14 at 06:19
You don't need to do anything about it when using official SDK. As long as your app secret is correct – cwhsu May 30 '15 at 09:47
This is a good answer, but you can go into the advanced settings for your app and disable 'require app secret,' of course you lose that added security. – Ecropolis Oct 19 '15 at 19:34
Facebook docs : $appsecret_proof= hash_hmac('sha256', $app_access_token, $app_secret); When it really is $appsecret_proof= hash_hmac('sha256', $access_token, $app_secret); Check it out, It works with ACCESS_TOKEN, no APP_ACCESS_TOKEN – Jonatan Jun 16 '16 at 04:46
How do I get this $app_access_token? I tried $app_id|$app_secret, also tried the acces Token that's generated from tools and support for publish_actions. Please help. – Koushik Das Feb 06 '17 at 14:52

score 9 · Answer 4 · answered Sep 25 '13 at 21:14

9

There is a bug in the Facebook SDK. After 20 hours of trying everything to debug my own code (which had no issues!), I commented this out in base_facebook.php:

/* Commented out by SJ 
    if (isset($params['access_token'])) {
      $params['appsecret_proof'] = $this->getAppSecretProof($params['access_token']);
    }
*/

And all the problems went away!

answered Sep 25 '13 at 21:14

MrMoxy

392
4
13

8

You may be using a different app id for the parts of your code with which you generate the token and when you use it. – Mike Oct 21 '13 at 16:25
2

Please note that if you are using a Facebook Page Access Token you should generate a new session from it passing page access token as an argument. This should be return of your function: return new FacebookSession( $access_token ); – Ivo Pereira Jan 06 '15 at 21:23
I strongly recommend you not to disable appsecret_proof either by comment the code or FacebookSession::enableAppSecretProof(false); . That is simply not the right thing to do. @Mike's suggestion is probably right for most of you. You might just be using wrong facebook id or secret. – cwhsu May 30 '15 at 09:51

score 3 · Answer 5 · answered Jul 06 '17 at 09:01

This is error is because of in correct token. It may be because you are using different account for configuring web app and mobile app for Facebook configuration. Both accounts should be same.

The app ID must be the same for your mobile app and your web app.

score 1 · Answer 6 · answered Nov 23 '13 at 08:36

1

This error is the result of setting incorrect access token. For e.g posting to page album using a user's(admin's) access token. I have solved this error almost all the times by setting the proper access token

answered Nov 23 '13 at 08:36

vinayhudli

99
8

score 1 · Answer 7 · answered May 23 '14 at 13:31

If this error is unexpected behavior, you may have checked a setting in your app to require it. Uncheck it and you should stop getting that error. That setting is in settings -> advanced and is called "App Secret Proof for Server API calls". Set that to NO.

As of now, that setting is on this page (make sure to put your appId in the URL): https://developers.facebook.com/apps/YOUR-APP-ID/settings/advanced/

Note this is not a universal solution, only a solution for people who don't want that behavior.

I don't have such setting in Advanced. The closest match is "Require App Secret". — Andor, Feb 01 '16 at 15:08

score 1 · Answer 8 · edited Dec 30 '20 at 23:21

For me it was three fixes that made it work

Activate the Secret app and Access to API in the advanced configuration of your app in Facebook for developers. Although in theory it is not needed for me it always prompted that the appsecret_proof was needed even when those two options were off.

When creating the appsecret_proof, the access_token used to create it should be the same access_token to send in the request, and its the user access_token, my error was that I was using the app access_token. Use the user access_token.
Send the parameter appsecret_proof as appsecret_proof, not as app_secret_proof. A minor detail but happened to me.

Extra: For python you can create the appsecret_proof like this:

import hmac
import hashlib

facebook_app_secret = '<your_app_secret>'
facebook_access_token = '<your_user_access_token>'
appsecret_proof = hmac.new(facebook_app_secret.encode('utf-8'),
                           msg=facebook_access_token.encode('utf-8'),
                           digestmod=hashlib.sha256).hexdigest()
print(appsecret_proof)

Gotten from facebook graph api calls with appsecret_proof in python

enabling API call worked it for me. Thanks – stanley mbote Apr 20 '21 at 07:33 — stanley mbote, Apr 20 '21 at 07:33

score 0 · Answer 9 · answered Jun 24 '15 at 12:26

0

make sure your setting correct fbappid + fbappsecret

this error happens when those are not set correct

like you have 2 apps one development and one production

and you mess up the codes, double check those two

answered Jun 24 '15 at 12:26

Jacek Pietal

1,980
1
18
27

score 0 · Answer 10 · answered Oct 28 '15 at 09:57

0

Just for people having the same problem;

When you set Client OAuth Login to "yes" on facebook, you should give proper Valid OAuth redirect URIs . Otherwise facebook throws exactly the same error.

answered Oct 28 '15 at 09:57

Süha Boncukçu

913
1
10
29

score 0 · Answer 11 · answered Mar 15 '17 at 11:00

In my case I needed to set Default Access Token via method: setDefaultAccessToken()

I used token generated in GraphApi dev tool but I did not switch into proper application. It was solved by changing application into proper one and using regenerated token.

score 0 · Answer 12 · answered Nov 19 '18 at 07:25

0

I know that this is an old question but I solved mine by changing the Application to the proper application that I should be generating an access token with. E.g. from Project1 to Project2.

answered Nov 19 '18 at 07:25

zekromWex

280
1
4
17

score 0 · Answer 13 · edited May 09 '19 at 19:11

0

Perhaps something wrong with your access token, you need Business Manager style. You can get the token from the content of https://business.facebook.com/settings/system-users/{sys_user_id}?business_id={business_id} with regex r'"accessToken":"([\d|\w]+)","context"'

edited May 09 '19 at 19:11

marc_s

732,580
175
1,330
1,459

answered Dec 07 '18 at 01:00

Xun Lee

313
1
3
12

score 0 · Answer 14 · edited Jul 31 '19 at 01:34

0

Works for me:

$appsecret_proof = hash_hmac('sha256', $facebook_page_token, $app_secret);

WHERE facebook_page_token is the page token stored in my database created when I associate the page to the app.

edited Jul 31 '19 at 01:34

giser_yugang

6,058
4
21
44

answered Jul 31 '19 at 01:14

DAVEWV

1

score 0 · Answer 15 · edited Jul 29 '21 at 10:12

0

Problem comes from wrong platform access token.

You should check your dashboard which you preferred to API and check your access token where it comes from.

edited Jul 29 '21 at 10:12

marc_s

732,580
175
1,330
1,459

answered May 10 '21 at 12:56

Enver

542
5
7

why do I get "Invalid appsecret_proof provided in the API argument"

15 Answers15

Linked