即使使用offline_access，Facebook访问令牌也会过期

Question

Users login Facebook on my website via an URL that redirects them to https://graph.facebook.com/oauth/authorize?client_id=116908145XXXXXX&display=page&scope=offline_access&redirect_uri=http://localhost:8000/account/services/?service=facebookcallback

On the callback page I make a request with the code I receive to get the access token, at this URL

https://graph.facebook.com/oauth/access_token?code=2.3m2hLauQJpWTGFExUK6O3w__.3600.1290081600-100001796185871%7.....&format=json&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Faccount%2Fservices%2F%3Fservice%3Dfacebookcallback&client_id=116908145040447&scope=offline_access&client_secret=...

The response I get is this access_token=116908145XXXXXX|2.3m2hLauQJpWTGFExUK6O3w__.3600.1290081600-100001796185871|S3MG...&expires=3912

As it can be seen from the token it has an expiration date.

The token expires some hours after the request. Shouldn't I receive an access token without expiration date if I make the requests with scope=offline_access ?

Answer 1

Old post, but the info might be useful for someone else.

Facebook now disables offline_access by default. You must enable an app migration if you still want to use it.

With the migration off, tokens will be "short lived" and last only an hour or two. You can get an extended token which lasts about 60 days by making a request to

https://graph.facebook.com/oauth/access_token?             
    client_id=APP_ID&
    client_secret=APP_SECRET&
    grant_type=fb_exchange_token&
    fb_exchange_token=EXISTING_ACCESS_TOKEN 

See this page for more details

Answer 2

tokens you get with offline_access permissions, are "long-lived" as facebook says in their documentation, but it is not said that it has no expiration / infinite. Even if you get this not-time-bounded access_token, it can still expire if the user changes his password or if he removes your application.

But to answer your question directly, yes you should get a long-lived access_token using "scope=offline_access". Also, please check if the dialog showed "Access my data anytime"