Facebook Api Check Access Token Without Hardcoding App Secret

Question

I'm building a manual login flow for my App which is integrating some facebook functionality. I need to check when the current access_token of the user will expire. The API documentary says I should do this call:

GET graph.facebook.com/debug_token?

input_token={token-to-inspect} &access_token={app-token-or-admin-token}

So I did this in C#:

        Uri inspectAccessTokenUri = new Uri("http://graph.facebook.com/debug_token?input_token="+access_token+"&"); //IDK which value should have the last parameter
        HttpWebRequest checkToken = (HttpWebRequest)WebRequest.Create(inspectAccessTokenUri);
        var response = await checkToken.GetResponseAsync();
        Stream stream = response.GetResponseStream();
        StreamReader reader = new StreamReader(stream);
        string data = reader.ReadToEnd();
        Debug.WriteLine(data);

The last parameter should be the app-token:

BUT: Of course I looked up how to get the app-token and facebook says:

Note that because this request uses your app secret, it must never be made in client-side code or in an app binary that could be decompiled. It is important that your app secret is never shared with anyone. Therefore, this API call should only be made using server-side code. (Facebook Graph API Documentation 1.1.16)

So my question: Can I check the token without the app-token or hardcoding the app-secret?

Answer 1

If the app-token is expired you will get a facebook response error. And you can catch this exception to deal with the situation you want. In this way you don't need to make a request with your app secret. You can also use fb-uwp sdk that contains AccessTokenData for authenticated users