Search code examples
facebookfacebook-graph-apifacebook-access-tokenfacebook-group

Not understanding when a user_token is required vs access_token

I am having trouble understanding how FB determines if a user-token or an access_token is required. I am not using Facebook for authentication in anyway, and really didn't want to.

I am trying to display information from our Facebook Group to our Forum.

According to the Graph API, /group-id/feed requires these:

  • A user access token, for a member of the group, with user_groups permission is required.
  • An app access token can read posts it published in app and game groups that belong to it.

/group-id/events requires only:

  • A user access token for a member of the group with user_groups permission.

The text is slightly off, but look to me to be conveying the same thought about "user access token".

According to FB, in place of a user access token, it is possible to combine an app's app-id and app-secret to simulate an access_token.

When doing this for my group's feed, it works great. When doing this for the events, I get an error that says:

  • Code: 102
  • Message: "A user access token is required to request this resource."
  • Type: OAuthException

Why is the app-id|app-secret access_token not working? I really don't want to worry about any FB authentication; I just wanted to list our events on our website. Am I doing something wrong or missing the proper way to handle it?

$(function () {
    var location = document.URL;
    var ShowGroup = false;
    var group_id = null;

    if (location.indexOf("chattanooga-lodge") != -1) {
        group_id = "";
        ShowGroup = true;
    }

    if (ShowGroup) {
        $("#FBfeedContainer").show();
        // Initialize Facebook JavaScript API
        window.fbAsyncInit = function () {
            FB.init({
                appId: 'app-id',
                xfbml: true,
                version: 'v2.0'
            });

            //FB News Posts
            FB.api(
                "/" + group_id + "/feed",
                { access_token: "app-id|app-secret" },
                function (response) {
                    debugger;
                    if (response && !response.error) {
                        $.each(response.data, function (index, data) {
                            if (index < 3) {
                                $("#FBfeed").append(data.id);
                            }
                        });
                    }
                }
            );

            //FB Events
            FB.api(
                "/" + group_id + "/events",
                { access_token: "app-id|app-secret" },
                function (response) {
                    debugger;
                    if (response && !response.error) {
                        $.each(response.data, function (index, data) {
                            if (index < 3) {
                                $("#FBfeed").append(data.id);
                            }
                        });
                    }
                }
            );
        };

        (function (d, s, id) {
            var js, fjs = d.getElementsByTagName(s)[0];
            if (d.getElementById(id)) { return; }
            js = d.createElement(s); js.id = id;
            js.src = "//connect.facebook.net/en_US/sdk.js";
            fjs.parentNode.insertBefore(js, fjs);
        }(document, 'script', 'facebook-jssdk'));
    }
});
Solution

  • You will not be able to fetch a Group's events without using any user authentication. As you already pointed out about permissions mentioned for group-id/feed (requires either user access token or app access token) and group-id/events (requires user access token) endpoints. You are able to fetch feed data because of the App access token that you created by combining app id and app secret.

    Each data point in Facebok API is strictly guarded by permissions. Some of them are public, others are accessed different type of access tokens depending on what Facebook finds should be accessible to whom. You can read more about it here https://developers.facebook.com/docs/facebook-login/access-tokens

    For your purpose of showing your group's events on a web page, you may have to do a work around. You will have to create your own Access Token and hard code it. Obviously you should not do that in Javascript but user PHP API