Facebook Page Access Tokens - Do these expire?

Page Tokens expire when the access token expires for the user that the page token was generated from. Edit 6.28.2013: If you extend the user access token and obtain a new page access token for the user, that page token will not expire unless the user de-authorizes your app.

Offline access has now been deprecated, but you are allowed to extend an access token to last for 60 days. If you extend the user's access token, then the page tokens generated from that user account will also have their expiration extended to match will not expire (edited 6.28.2013). The value for the page tokens may change after being extended, so be sure to grab new page tokens from the user's /accounts graph connection after extending the user token.

You can continue to extend these access tokens once per day. So you should regenerate the access tokens each day that the user interacts with your app.

See https://developers.facebook.com/docs/facebook-login/access-tokens/#pagetokens https://developers.facebook.com/docs/facebook-login/access-tokens/#extending https://developers.facebook.com/docs/facebook-login/
https://developers.facebook.com/roadmap/offline-access-removal/ https://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/

You can extend a page access token to make it never expire. The documentation is a little muddy, but the following pages have pertinent information, and you will obviously need to be an administrator of the page. Pay close attention to scenario 4 and 5 at the second link.

https://developers.facebook.com/docs/reference/api/page/#page_access_tokens https://developers.facebook.com/roadmap/offline-access-removal/#page_access_token

It is simple using the graph explorer to retrieve tokens from Facebook. The graph explorer also allows you to debug the token which will list the expiration date, thus you can verify that it never expires. Graph Explorer: https://developers.facebook.com/tools/explorer

Click on the Get Access Token button to retrieve your token. Keeping your id in the query bar, simply append /accounts to your id, so that it looks like this: /123456789101112/accounts. Make sure it is a GET request (The drop-down to the left of the query bar).

This will retrieve all pages that you are configured to work with. You then need to make a GET request to:

/oauth/access_token?client_id=APP_ID&client_secret=APP_SECRET&grant_type=fb_exchange_token&fb_exchange_token=EXISTING_ACCESS_TOKEN 

Your APP_ID and APP_SECRET can be found in your applications administration settings. Use your personal access token as the final parameter (EXISTING_ACCESS_TOKEN). This will return a 60 day personal access token. Copy this token into the Access Token bar, which is above the query bar. Now make a GET request to USER_ID/accounts like we did towards the beginning. This will again return a list of pages that you are configured to work with.

But this time the page tokens that are listed with the pages do not expire. You can check this by copying a page token into the Access Token bar, and clicking the Debug button. This will give you details on that access token, including the expiration time, which should be never in this case.

UPDATE

I have also found that Facebook's graph explorer sometimes get confused with user context, and may not be reliable at all times. Alternatives are Fiddler or Postman.

I'm not sure if facebook has made changes to fix these bugs or not but it seems that user access tokens do not expire once page access tokens are granted for the user. Based on my testing the flow goes something like this:

1. User access token requested -> 60 day user token is issued
2. Page access tokens requested -> page access tokens issued that never expired and initial user access token is upgraded to never expire as well.

Hope this clears up some of the confusion on here. I have tested this with many different users in our app and see the same thing each time.

If page access tokens are never requested, the original user access token will expire after 60 days.

Facebook page access token is very similar to User access token except that "it impersonates the user" as the admin of the page and allows to manage it [manage_page permission is required].

If Offline_access permission is granted to the app the page access_token WILL NOT expire (unless the user changes their password or manually deauthorises the app)

Use the following link to check the details of an issued access token.

https://developers.facebook.com/tools/debug/