I have integrated facebook oauth into my apps registration flow. On a high level, we are using oauth to verify the identity or new applicants to our app, as well as fetch some of their social platform information, which we then store for review. Our team then uses this data to vet an applicant before approving them to gain full access to our app.
Our specific process is as follows: On the frontend, the following link is available for the user to authenticate via facebook: https://www.facebook.com/v22.0/dialog/oauth?client_id={our_id}&redirect_uri=https%3A%2F%2F{our_url}%2Foauth%2Ffacebook%2Fcallback&scope=email%2Cpublic_profile%2Cpages_show_list%2Cpages_read_engagement&state=${encodedState}`;
Then on a successful oauth, our redirect url does the following: uses the code to fetch the facebook access token ->
public InstagramTokenResponse getFacebookAccessToken(String code, String redirectUrl) throws Exception {
URI uri = new URI(String.format("https://graph.facebook.com" + "/v22.0/oauth/access_token?client_id=%s&redirect_uri=%s&client_secret=%s&code=%s", facebookClientId, redirectUrl, facebookClientSecret, code));
log.info("Getting facebook access token " + uri.toString());
return restTemplate.getForObject(uri, InstagramTokenResponse.class);
}
next we use that access token to fetch the users details ->
public FacebookUserDataResponse getFacebookUser(String accessToken) throws Exception {
URI uri = new URI(String.format("https://graph.facebook.com" + "/v22.0/me?fields=id,name,email&access_token=%s", accessToken));
log.info("Getting facebook user " + uri.toString());
return restTemplate.getForObject(uri, FacebookUserDataResponse.class);
}
Next we fetch their facebook page related data to estimate follower count ->
try {
facebookPagesResponse = oAuthServiceClient.getFacebookPages(facebookUserAccessToken);
for (FacebookPage page : facebookPagesResponse.getData()) {
String pageAccessToken = page.getAccess_token();
String pageId = page.getId();
FacebookPageDetails pageDetails = oAuthServiceClient.getFacebookPageDetails(pageId, pageAccessToken);
followerCount += pageDetails.getFan_count();
}
} catch (Exception e) {
LOG.info("OAuth failed to get facebook pages or their information");
}
Here you can see how our client fetches facebook pages and their details ->
public FacebookPagesResponse getFacebookPages(String accessToken) throws Exception {
URI uri = new URI(String.format("https://graph.facebook.com" + "/me/accounts?access_token=%s", accessToken));
log.info("Getting facebook pages " + uri.toString());
return restTemplate.getForObject(uri, FacebookPagesResponse.class);
}
public FacebookPageDetails getFacebookPageDetails(String pageId, String pageAccessToken) throws Exception {
URI uri = new URI(String.format("https://graph.facebook.com" + "/%s?fields=name,fan_count&access_token=%s", pageId, pageAccessToken));
log.info("Getting facebook page details " + uri.toString());
return restTemplate.getForObject(uri, FacebookPageDetails.class);
}
We are already approved for pages_read_engagement and instagram_basic, our app is verified and live. But for some reason, when someone not on our dev team attempts to use this flow, it consistently fails to even authenticate. Instead of getting the typical "login with facebook" redirect we get redirected to a "Feature Unavailable" page (see screen shot)
It never even gets to our redirect url. This is frustrating as we tested this all extensively among our team members but never ran into this issue. Can anyone please help me figure this out!
One potential reason may be because pages would only work with a facebook business type app?
