Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is it possible to pass Facebook Graph API access token through request header?

I am testing Facebook Graph API v2.3 with Postman. While it is possible to get response by putting access token in query string as follow:

https://graph.facebook.com/v2.3/me?access_token=my_access_token 

I am wondering whether it's possible to do the same thing with HTTP request headers, which would be something like this:

GET /v2.3/me HTTP/1.1 Host: graph.facebook.com Authorization: <my_access_token> Cache-Control: no-cache Postman-Token: <postman_token> 

Based on this similar question (i.e. How should a client pass a facebook access token to the server?) on Stackoverflow, it seems that this should be possible.

Any thoughts on this?


Edit:

What raised my interest is that, when I used the API Graph Explorer provided by Facebook Developers, it seems that there's no query string in that sandbox either. How does that work?

Facebook API Graph Explorer DO use query string for access token. Thanks to @CBroe's response.

like image 580
kavare Avatar asked Apr 26 '15 11:04

kavare


People also ask

How do I pass a header token?

To send a request with the Bearer Token authorization header, you need to make an HTTP request and provide your Bearer Token with the "Authorization: Bearer {token}" header. A Bearer Token is a cryptic string typically generated by the server in response to a login request.

Does FB Graph API access token have no session expiration?

Long-lived Page access token do not have an expiration date and only expire or are invalidated under certain conditions. You will need the following: A valid long-lived User access token.


1 Answers

Yes it is possible

Authorization: Bearer AccessTokenHere 

e.g.

curl --header "Authorization: Bearer CAAC...ZD" https://graph.facebook.com/me

This answer previously recommended using "OAuth" instead of "Bearer" as the token type. Both will work, but "Bearer" is the type that shows up in the standard. Also, on completing Facebook's OAuth flow, the token_type in their response is bearer. So all in all "Bearer" makes more sense.

like image 156
phwd Avatar answered Sep 20 '22 01:09

phwd