Facebook Graph API - 使用 'app access token' 获取 facebook 页面提要(解决方案)

Question

嗯，这听起来很奇怪。当 facebook 应用程序配置为 native /桌面应用程序时(应用程序->您的应用程序->高级->应用程序类型)，“应用程序访问 token ”从此过程中获取

https://graph.facebook.com/oauth/access_token?" + "client_id=" + APP_ID + "&client_secret=" + APP_SEC + "&grant_type=client_credentials"

无法从 Facebook 页面获取提要或发帖。根据 Facebook 文档获取提要只需要任何有效的 access_token 或用户 access_token，奇怪的是，如果应用程序配置为 native /桌面，它就无法以这种方式工作。

1经过一天的研究，找到了解决方案，得出令人沮丧的结论，即必须在(应用程序->您的应用程序->高级->应用程序类型)中将其配置为基于“网络”的应用程序。

设置完成后，上述获取提要的过程就可以正常工作了。这引发了一个问题，这是一个错误吗？或者我误解了文档。

我希望我为你节省了一天时间，如果你这几天一直在处理 Facebook 页面提要并且因为明显的原因而感到沮丧而焦头烂额。

[1] Facebook forum post

Answer 1

这是关于使用应用程序访问 token 的相关文档

App Access Tokens should only be used when the posting functions are originated directly from your servers in order to keep them private to the app. For example, you should not publish using an App Access Token from within a client such as a native mobile app. Doing that could allow individuals to obtain the App Access Token, which could then allow them to take actions on behalf of your app. Instead, you should have your native mobile app queue actions up with your server and then have your server publish the stories to Facebook using the App Access Token. For this reason, if your 'App Type' in Settings > Advanced is set to 'Native/Desktop', we assume that your client app contains the App Secret or an App Access Token in its binary, and do not allow calls signed with an App Access Token to proceed. The API will behave as though no access token was provided.

Source

还有关于获取应用访问 token 的信息:

Because it requires you to include your App Secret you should not attempt to make this call client-side as that would expose this secret to all your app users. It is important that your App Secret is never shared with anyone. For this reason, this call should be performed server-side [...]

Source