Refresh expired access tokens using serverside flow automatically

Question

Well there seems to be quite a bit of confusion on this topic and I am struggling to get a clear answer, so here is my question...

I am using the serverside flow to obtain access tokens for my web app, I previously used offline_access which is now being depreciated so I need a way to refresh the token in the following situations:

1) User changes FB password 2) Token expires naturally

My app posts results to users FB walls so the refresh needs to be done automatically by our server (no cookies or OAuth dialogs)

I thought I could try to use the new endpoint described here

http://developers.facebook.com/roadmap/offline-access-removal/

, with the following piece of code (Java):

public static String refreshFBAccessToken(String existingAccessToken)
        throws Exception{
    //Currently not working
    String refreshUrl = "https://graph.facebook.com/oauth/access_token?
        client_id="+FacebookApp.appId+"
        &client_secret="+FacebookApp.appSecret+"
        &grant_type=fb_exchange_token
        &fb_exchange_token="+existingAccessToken;
    URL url = new URL(refreshUrl);
    URI uri = new URI(url.getProtocol(), url.getHost(), url.getPath(),
            url.getQuery(), null);
    String result = readURL(uri.toURL());
    String[] resultSplited = result.split("&");
    return resultSplited[0].split("=")[1];
}

But this doesnt seem to work (I get a response 400), and when I re-read the documentation it seems this endpoint is used for tokens obtained using the client-side flow only...

So what about the serverside flow....?

Can someone tell me if the approach above is correct or there is another way?

Many thanks

Answer 1

From what I understand there is no server side flow for refreshing tokens.

The refresh token call needs to include the response of the user authentication process which is a short lived token.

You will need to include the refresh token process as part of the user login flow or if this doesn't work for your setup you will need to email the user asking them to come back!