I am running a workflow service which automatically posts messages from some blogs on a facebook page. But now facebook deprecate the offline_access permission and I need to find a solution if my application does not run for example 60 days and the access token expired.
I need to find a way to get a new access token with given username and password without user intervention...
Maybe someone of you have a good idea
If your service make timed requests to the Facebook API, you won't need to worry about the token expiration. So, if you request some status or a specific FQL on a timed interval, your token will be extended and will let you post anytime you want.
This solution is a workaround. Even you try to do that, you won't cover all the scenarios. The better way is to mantain the user connected to your app, verifying some constant content day-by-day. With this behavior, you will have an access token for every entrance of the user.
Hope it works.
Related
I've searched a lot and I've read a lot about this thing, but all the solutions were to get the access token by copy it manually.
is there a way to get the access token automatically by an API request?
It is possible. First of all, you have to integrate the facebook login to generate a user access token.
Look here to get started with the facebook login
The problem with this token is, it expires really fast:
Default User and Page access tokens are short-lived, expiring in hours, however, you can exchange a short-lived token for a long-lived token.
However you can use this to generate a long lives access token which expires normally in 60 days. Additionally it will get refreshed when the user uses your app within this 60 days.
This is the URL to generate the Long-Lives Access Token. You have to enter your app-id, app-secret and access-token. All three can be found inside the app you created on the facebook developer page.
"https://graph.facebook.com/{graph-api-version}/oauth/access_token?
grant_type=fb_exchange_token&
client_id={app-id}&
client_secret={app-secret}&
fb_exchange_token={your-access-token}"
Offical documentation to generate a Long-Lives Access Tokens
Hint: You can test all commands through your browser. Just replace the placeholders in the url with your data and put them into the URL-bar. Then you will get an JSON-response from the facebook graph API.
I am making an API call that requires OAuth2. I initially make the call and authorize it with a login via the web. I'm then taking the supplied Refresh Token and using it to make subsequent calls in my application.
The issue is that in the subsequent calls the Refresh Token is used up and I get a new one. I save this new one in the database and then use that saved one on the next call. This works great for about xx number of calls and then for some reason the Refresh Token goes bad and I have to go and manually grab one through the web login again.
I have no way to tell, that I know of, when the token goes bad or why.
Is there a way to just send the login info or the OAuth2 info or something that'll get me a new valid Refresh Token without me having to "authorize" my own app?
The API that I am using is Constant Contact.
The OAuth standards are based on 2 forms of expiry:
ACCESS TOKENS
These are short lived API credentials and a common lifetime is 60 minutes. When they expire the API client receives an HTTP response with a 401 status code. The client can then try to silently renew the access token.
REFRESH TOKENS
These are long lived credentials that represent a user session, and a common lifetime is 8 or 12 hours. During this time the access token can be renewed silently. Eventually however, the refresh token itself expires and the silent renewal request results in an error with an invalid_grant error code.
USER RE-AUTHENTICATION
There are very good reasons for making users re-authenticate and I would avoid trying to bypass this. Tokens that last for a very long time are not recommended. Usability can be pretty good with only an occasional re-authenticate operation, along with features such as password autofill.
FURTHER DETAILS
See steps 26 and 29 of my Message Workflow
Code that handles 401 checks
Code that handles ErrorCodes.invalidGrant
Please Let me Know how to accomplish my task, connecting to Oauth without any interaction of the user and also the Oauth should not be expire or any way to prevent it from expire.
it would be great if you can provide me detailed code in c#.
You can't accomplish what you're trying to accomplish. It's impossible.
Intuit requires that the user be involved in the OAuth process. They must click the [Connect to QuickBooks] button at least ONCE to go through the OAuth process and get the OAuth tokens.
Additionally, Intuit forces OAuth token expiration after 180 days. You can refresh/renew the token within 30 days of the expiration.
Please go read the documentation, where this is all very clearly explained:
https://developer.intuit.com
We have an audio blogging website which can be configured to publish links to the user's Facebook timeline whenever they make a new blog entry.
To do this, we have the user authorise our app when they set up the link to their Facebook account. We obtain the publish_stream, offline_access and manage_pages permissions (more on that later).
All the code is in C# but the principles apply to any language as it's the workings of the Facebook API we are concerned with. We're using OAuth 2 and the Graph API to achieve all of this.
So, we obtain an app access token using our app ID and secret and use that token to publish to the user's timeline, this works fine (because they have already authorised our app to do this). We can also query the Graph API and get their likes, friends and various other data.
NOW HERE IS THE PROBLEM:
Some of our users want to publish updates to their own timelime and also to the timelines of pages that they manage. In theory this is simple: you query the API for the pages that the user manages using this url: https://graph.facebook.com/{userid}/accounts?access_token={token}
The JSON returned from this call is said to contain the page IDs and the page access tokens for those pages. You then use the page access token to publish to the pages' timelines.
However, when we try to call this URL with the app access token we are getting an OAuthException 102 "A user access token is required to request this resource".
Note this is different to OAuthException 104 "An access token is required to request this resource" (which is what you'd get if you neglected to pass an access token), and also OAuthException 190 "Invalid OAuth access token signature" (which you would get if the access token was not a valid one).
So our access token is valid, but just not valid for this particular url. It seems therefore that we need a user access token and not an app access token for this particular feed (I am long past caring why this is the case, it just seems to be the way it is).
All the Facebook documentation on this subject (and I must have read all of it by now) leads to one place: http://developers.facebook.com/docs/authentication/server-side/, aka the "Server-Side Authentication Flow" page. This page describes how to get the elusive user access token by redirecting the user to the auth dialog and asking for the relevant permissions but we need to achieve this without interaction from the user and the user has already given our app all the permissions we need. All of this automated publishing happens server side in the post-processing of the audio so we cannot interact with the user at this stage anyway.
I don't get it. Why is it we can use the app access token to get almost any data we want from the user (well, whatever they have given us permission to get) but the /accounts data we need a different (user) access token for?
Can anyone shed any light on how we can get a user access token which will allow us to get the /accounts data for our users without any further interaction from the user?
So our access token is valid, but just not valid for this particular url. It seems therefore that we need a user access token and not an app access token for this particular feed
Due to the permissions per type of access token, you do need a valid user access token in this particular case. Read all about access tokens and types. That's just the way it is.
This page describes how to get the elusive user access token by redirecting the user to the auth dialog and asking for the relevant permissions but we need to achieve this without interaction from the user and the user has already given our app all the permissions we need.
If your user already has given his/her permissions, why are you struggling then? I suggest you persist the user access token. From this endpoint:
https://www.facebook.com/dialog/oauth?client_id=..&redirect_uri=..&state=..&scope=..&response_type=..&display=.."
you retrieve a code, like this:
YOUR_REDIRECT_URI?code=OAUTH_CODE_GENERATED_BY_FACEBOOK&state=YOUR_STATE_VALUE
Use this code to generate your user access token, as explained here:
https://graph.facebook.com/oauth/access_token?client_id=..&redirect_uri=..&client_secret=..&code=..
This will result in a response like:
access_token=USER_ACCESS_TOKEN&expires=NUMBER_OF_SECONDS_UNTIL_TOKEN_EXPIRES
There it is, your user access token. Persist it. As you can see it expires after the value indicated in the response. If you are using the new API, it should indicate 60 days (that brings me back to this: offline_access is deprecated and results in short-lived - valid for 2 hours - tokens), link. Whenever your user logs in to your app and uses the Facebook integration, the tokens gets refreshed to again, 60 days. This means, that IF your user should not login to your app and use it for 60 days, it will expire.
You can check whether the user access token is expired with:
https://graph.facebook.com/debug_token?input_token=INPUT_TOKEN&access_token=ACCESS_TOKEN
If that does: renew the user access token by using your app access token, it is well documented right over here. But I'm quoting this part:
Server-side Login
To obtain a fresh [user] access token in this case you must pass the user through the full server-side Login flow again. However, assuming the user has not de-authorized your app, when you redirect the user to the OAuth Dialog, they will not be prompted to reauthorize your app, and will be immediately redirected to the redirect_uri. This means that the re-authentication process can appear reasonably transparent to the user.
Bottom-line: there are no user access tokens that are valid for ever, the app access token however is. Persist your user access token and check whether it is still valid before performing API calls with it. A normal user should use your app within 60 days and should not just de-authorize your app for fun. Hence the use case in which the user should re-authorize is fairly rare, however, you need to expect it.
Ok here is my question.
I understand the process of the OAuth protocol, however I have some confusion around it.
I'm trying to take advantage of DotNetOpenAuth.Here is where I don't get things.
Suppose a user (a new user), attempts to login to my website using Twitter.
The process goes like this (feel free to correct me if I'm wrong):
A request token is issued (if my ConsumerKey and ConsumerSecret are ok).
Then an authorization token is issued and the user is redirected to Twitter.
The user authorizes my application. And an access token is issued.
I get the current user's details and store them in the database (along with the access token).
So far, so good.
Now here is the confusing part. The user logs out. Then comes back and tries to authenticate with Twitter again. How do I determine his access token, If I can't get his identity before I have the access token ? I have him in the database, however I can't determine who he is, before he goes through the same steps all over again. I'm sure I'm missing something, and I'll appreciate it if you point it out. I'm aware of the IConsumerTokenManager, I tried reverse engineering the InMemoryTokenManager and see how it works, but it's still not clear.
Ah, the joys (ahem, lack thereof) of using an authorization protocol for authentication. I dislike OAuth for logging in. Grrr...
With that out of the way, let me clarify the flow a bit:
An "unauthorized" request token is issued (if your ConsumerKey and ConsumerSecret are ok).
The user authorizes your application, and is sent back to your application
Your request token is now "authorized" and DotNetOpenAuth exchanges it for an access token.
You use the access token to get the current user's details and store them in the database.
When later, an anonymous user visits your site and wants to log in, you start the flow all over. Only this time, since Twitter recognizes the user (after they log in if need be) Twitter will likely immediately redirect the user back to your application rather than ask the user to confirm the login. The request token will be authorized, you'll exchange it for an access token, and you'll use that to get the user's data. Oh! Now you see that the data matches an entry already in your database, and you welcome your visitor back.