Allowing multiple domains for 1 Facebook App (like Tumblr)

Question

I am trying to get my website validated with the Facebook object debugger and I'm running into the following error:

Object at URL 'http://www.example.com/latest' of type 'smallteaser:teaser' is invalid because the domain 'www.example.com' is not allowed for the specified application id '597566643589666'.

This error makes perfect sense since I haven't allowed the example.com domain specific access to the Facebook app. But do I really have to?

What I would like to achieve is similar to how Tumblr works when a custom domain is used. Say, for example, the website www.davidslog.com: it has the following meta tags:

<meta property="fb:app_id" content="48119224995" />

   --> This is the Tumblr app ID


<meta property="og:url" content="http://www.davidslog.com/?og=1" />

   --> This is a custom domain which points to a Tumblr blog


<meta property="og:type" content="tumblr-feed:tumblelog" />

   --> This is a custom Tumblr object type (in namespace tumblr-feed)

And if you then compare this with, for instance, the domain theartofnotwriting.tumblr.com, which has the following metadata:

<meta property="fb:app_id" content="48119224995">

   --> This is the same Tumblr app ID

<meta property="og:url" content="http://theartofnotwriting.tumblr.com/?og=1">

   --> This is a different domain

<meta property="og:type" content="tumblr-feed:tumblelog">

You can clearly see that the same Tumblr app has multiple URLs and everything validates correctly.

So why is it that this Tumblr page validates correctly and mine doesn't? How can a Facebook app be configured to allow being used on multiple domains?

Answer 1

I ran into this same issue. I figured that Tumblr must have some sort of partnership in place with Facebook to get this special treatment ( ip whitelist? special api? ) -- so I contacted my former Partnerships Rep at Facebook to enquire.

I got to speak with a platform engineer at Facebook about this, and I was totally wrong. There is nothing special going on.

The reason why all the domains running on Tumblr are validating fine with a single app_id, is that the facebook debug tool only checks the validity of the og_tag's structure (at least when it comes to the app_id). It does not validate if the app_id is properly associated with the given domain.

You can test this by putting up a test page with the your app_id on two different domains -- they'll both validate as fine in the debug tool.

When it comes to actual Facebook API access, Tumblr does everything on their domain. When people do use Facebook buttons/etc on Tumblr, it is often through a third party proxy tool (like ShareThis) or with a non-api button embed. I couldn't find a single custom-domain running on Tumblr that used the Facebook API or app_id related buttons. If you can, I'd love to see it.

It's the not answer you want (or I want) -- but that is what is happening. Tumblr's app_id appears on all the domains, but only actually works on ".tumblr.com"; The Facebook debug tool doesn't actually validate the app_id.

Answer 2

How can a Facebook app be configured to allow being used on multiple domains?

If you try to add more than one domain in the app settings, you get an error that looks like this:

example.com must be derived from one of: Site URL, Mobile Site URL, Canvas URL, Secure Canvas URL, Page Tab URL or Secure Page Tab URL.

example.org must be derived from one of: Site URL, Mobile Site URL, Canvas URL, Secure Canvas URL, Page Tab URL or Secure Page Tab URL.

One solution is to set the "Page Tab URL" to a fake URL on example.org like so:

example.org/myfakepage

You don’t actually have to use the page tab for anything. This just allows you to add a second domain.

Answer 3

How can a facebook app be configured to allow being used on multiple domains?

It can’t. Facebook apps are tied to one domain (and subdomains thereof).

Imagine what would happen otherwise – someone could add lots of (big) websites to one single app, and then f.e. embed the JS SDK on each of them, and recognize a user that is connected to that app over “half the internet” … and thereby track their (almost) every step.

Facebook of course does not want this¹ – because they want to make money of the data they collect about users and their movements through the web (they can in theory track you on every single website that uses a simple like button) – they would be stupid if they gave that same ability to every app developer.

¹ OK, that’s my own assumption.