Search code examples
facebookfacebook-graph-apifacebook-access-token

Facebook page access token broken after adding new permissions to user token

Based on the doc on Facebook page access token following steps are need to be taken to obtain a long-lived Page Access Token.

  1. Extend the User's Access Token which has the manage_pages permissions
  2. Get the page access token thru the /userId/accounts end point using the extended user access token.

This process is working fine and I am able to obtain and use the page access token properly.

The issue arises when the user grants a new permission to the App - such as 'publish_actions' to allow the App to post on the Page's timeline, the page access token obtained using the above mentioned mechanism does not work properly.

Until about a 6 to 8 weeks ago the new publish_action permission would allow the previously saved page access token to post on the page's timeline without any issue. This feature seems to have broken where I am getting the following error :

{"error":{"message":"(#200) The user hasn't authorized the application to perform this action","type":"OAuthException","code":200

When the access token is debuged using the Facebook debugger tool - it shows that the saved page access token is indeed embellished with the new permission as follows :

App ID  XXXXXXXXXXXX : App Name
Profile ID  999999999999 : Page Name
User ID  9999999999999999 : User Name
User last installed this app via API v2.x
Issued  1454463877 (40 minutes ago)
Expires Never
Valid   True
Origin  Web
Scopes  email, manage_pages, publish_actions, public_profile

So although this page token has publish_actions permission it is not able to post on the page's timeline. This has stopped working recently and looking for any other folks who have faced a similar issue and have managed to resolve it.

Btw, I have already tried refreshing the page access token using the newly generated user access_token at the time when the user gives the publish_actions permission. Going the thru the above 2 steps using the new user access token, seem to return the same page access token and it continues to fail to post on timeline...

Any help is much appreciated.

Solution

  • The issue was related to using incorrect permission. Facebook has introduced a new 'Publish_pages' permission which should be used to make posts on business pages. We were using publish_action which was invalid (since v2.3 or somewhere around that - we are using v2.5 of the graph API so it caused a problem).

    Facebook responded pretty quickly to our bug report and provided this guidance which helped resolve this issue (I should have posted this answer earlier).