Facebook API – Access Tokens

There are 3 different Access Tokens, each one with a specific purpose while dealing with the Facebook API. The Facebook docs cover the basics to get you started, it´s all about the Web here, so i will not cover the fourth one in the list: the “Client Token”.

App Access Token

This is the basic token, it´s for getting access to data “as App“. You will not get any user data with this one, but you can read the stream, the events and the albums of a Facebook page. You don´t even need to be admin of that page, but you can NOT get those channels without any Access Token.

The good thing is: In most cases you don´t even need to worry about the App Access Token (or any Token at all), if you are using one of the SDKs. If you include either the PHP SDK or the JavaScript SDK correctly, each call to the Facebook API will automatically include the App Access Token by default.

The docs mention two possibilities to get the App Access Token, one includes a call to the API and the second one is actually very easy to create:

APP-ID|APP-SECRET” (App-ID, Pipe, App-Secret)

Boom! That´s the App Access Token already. Just be sure not to share it with anyone, the App Secret should never be available to a user.

User Access Token

This is the most common Access Token, you only get it by authorizing the User. This is the one you need when you want to post stuff on the timeline of the User (please don´t create Spam Apps!), or if you want to get User information (Name, Facebook ID, Albums, Movies, …).

For testing, you can generate a User Access Token in the Graph API Explorer. Just select the App, press “Get Access Token” and the login dialog will show up. After authorizing, the User Access Token will be visible in the text field labeled “Access Token”:

Graph API Explorer - User Access TokenThe API Explorer will use the Token in the text field for every test call, next thing i´ll show you is to get a User Access Token with the PHP SDK and the JavaScript SDK.


How to initialize the PHP SDK is explained in my Facebook PHP SDK 4.0 Tutorial. After that you need to direct the User to the authorization/login URL:

Best practice is not to redirect the User immediately when he opens your App and did not authorize it yet. The User does not know what the App is about, so you better require authorization right when you REALLY need it, or you present an intro page to tell the User why you need his authorization.

After login, the User will get redirected back to your App URL (or another redirect URL you can specify), see the Facebook docs for further information: PHP SDK – getLoginUrlIf the User is authorized successfully, you can get his ID and make calls to the API easily. Don´t worry about the User Access Token, it will get added automatically:

JavaScript SDK

This is the one i prefer in most cases, because you don´t need a redirection. Usability to the max. For initialization, just put the code from the Facebook docs in your HTML file: Facebook API – JavaScript SDK
Right at the comment “Additional initialization code…” you put in your login call (see FB.login in the Facebook docs):

Of course you need to think asynchronous while using the JavaScript SDK. Always make sure that the SDK is initialized and the User is authorized before trying to make calls to the API. As i´ve already mentioned, you don´t need to worry about the User Access Token.

Extended User Access Token

By default, a User Access Token is valid for only 2 hours and you can extend it to 60 days. This is quite easy with the PHP SDK:

Of course this will only work if you got a standard User Access Token already (see section above). Apart from calling the “setExtendedAccessToken” function, there´s nothing else you need to do. You may want to store the Access Token in a database if you need to call the API on behalf of the user while he is not online. Which is the only reason why you would even want to create an Extended Access Token.

Extending the Access Token requires the App Secret, so you should never try to do that client-side. But you can do it without the PHP SDK, by making a server-side call to this URL (with “file_get_contents” or – much better – with “cURL“: https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id=[app-id]&client_secret=[app-secret]&fb_exchange_token=[short-lived-token]

Remember, user tokens are always limited to 60 days max – you can´t just request a new token with a cron job, you can only get a new Token with User interaction.

Page Access Token

The last important Access Token is used to manage Facebook Pages. It´s a bit more complicated to get that Token, these are the required steps:

  • get a valid User Access Token with the additional permission “manage_pages”
  • make a call to /PAGE-ID?fields=access_token with the Facebook API
  • get Page Access Tokens for all your Facebook Pages in an Array

I will only show you how it´s done with the PHP SDK, because there´s not much difference in using the JavaScript SDK for it:

From now on, each call to the API will use the Page Access Token. And that is exactly what you need if you want to write something on your Page wall as the Page itself.

Extended Page Access Token

The Page Access Token is valid for only 2 hours, like the default User Access Token. However, you can extended to a Token that is valid forever (and not just 60 days like the Extended User Access Token) by just using the code above for getting a Page Access Token with only one difference: you have to get a valid Extended User Access Token before calling /me/accounts:

Quite easy, right? If you just need one Extended Page Access Token without creating some code, use the Graph API Explorer:

  • Authorize with your App and copy the generated User Access Token (don´t forget the “manage_pages” permission)
  • Put that link with the correct IDs in the Browser: https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id=[app-id]&client_secret=[app-secret]&fb_exchange_token=[short-lived-token]
  • Copy the acquired Extended User Token back to the Graph API Explorer
  • Make a call to /me/accounts

Result: A list of all your Pages, including an Extended Page Access Token for every Page.

Useful Links

Any questions/suggestions? Feel free to comment and i´ll try to answer :)

20 thoughts on “Facebook API – Access Tokens

  1. Mark says:

    Thanks for this…!

    One question, I would like to gather reviews from a list of pages that are not owned by me.

    Does this mean that I have to request for a page access token from each page and does that mean that the admin of each page has to grant that access token?

    • hi! for reviews from other pages, you need a page access token. and that one you only get if you are admin of the page. so it is impossible to gather reviews/ratings from pages you do not own, unfortunately.

  2. solar poolheizung says:

    Do you mind if I quote a few of your posts as long as I provide credit and sources back to your webpage?

    My website is in the very same niche as yours and my users would certainly
    benefit from some of the information you present here.
    Please let me know if this alright with you. Appreciate it!

  3. Ashish says:

    I i don’t say thank you that would be a sin :)

    Spent numerous hours on how to get Page values, facebook page data after authentication but couldn’t found any help.

    Thankfully i landed on this page and it was bang on.

    After authentication save the token, page token in db and make a separate call to this function to get Page specific data.

    function getFacebookData($pageName, $type)
    $url = ‘https://www.facebook.com/’ . $pageName;
    $id = substr(strrchr($url, ‘/’), 1);
    $json = file_get_contents(‘http://graph.facebook.com/’ . $id);
    $json = json_decode($json);

    // if Type 1 return only id else return entire array
    return ($type == 1 ? $json->id : $json);

    I hope this will help someone finding the same solution.

    • which extended token? user token, i assume? you can´t auto retrieve a new one when it expires, it would make the whole concept of extending useless. user tokens are not supposed to get used if the user did not visit your app in more than 2 months.

  4. Kenny says:

    Thanks for clarifying my doubts about Facebook’s access tokens. Now that Facebook PHP SDK v5 is out, are these codes still valid?

  5. Joe says:

    So to have your app read pages that are both public and restricted (location) I will require a page token & app token? The app token works sufficiently to get all public data but cannot access restricted pages based on location. In your opinion which would be better to use as default in my application. The benefit of app tokens are that I have never needed to renew them as it seemed it renew by itself. Is the amount of data retrieve via the graph api the same with all tokens?

    • you do need a page token for restricated pages, yes. app tokens are not related to a user, that´s why. extended page tokens are always better, and you do not need to renew them. as you can read in my article, they are valid forever. app tokens are just “app-id|app-secret”, there´s nothing to renew because those things will most likely stay the same in the app. but again: use a page token if possible.

      • Joe says:

        I want to create a web service or API that provides a user a login window where they will enter their credentials. I want to then create an app on their behalf in order to acquire user and page tokens on their behalf. This will then be used by my apps to allow them to interact with certain pages. Is this possible? If so do could you perhaps outline how I could go ahead and do this? I have just mentally scoped this out and do not yet have any idea how to code this, but just want to make sure its possible. Appreciate your response.

Leave a Reply

Your email address will not be published. Required fields are marked *