Can you get a public Facebook page's feed using Graph API without asking a user to allow?

Question

I've never used Facebook's Graph API, or OAuth. I'm simply trying to get a public Facebook page's feed using the Graph API, but it requires an access token. I don't want to hassle the users to login and allow access to get their token. A Facebook app access token could be used to get a public feed, but I'm trying to do this entirely in Javascript, so I can't use the app secret to do so. I read somewhere that a Facebook app access token doesn't ever expire or change unless I manually reset the secret. Is this true? Would it be safe to just hard code in the Access Token? If not, is there some way I could authenticate an app to get the token without having to involve a user? Is there some type of generic app token I could use?

Solution 1

If you're anything like me your clients won't want a standard Facebook likebox plugin, they'll want it all styled and customised their own way.

You don't need to spend all day going round the official documentation wondering if any of it applies to you for something simple like this, it's quite easy. The confusion arises because you'd assume that with all these keys and secret ids you'd have to get permission or authentication from the Facebook page you wanted to pull the feed from - you don't. All you need is a valid app and you can get the feed for any public page.

Set your app up in Facebook and it will give you an app id and an API key. Get the profile id for the public page feed you want, and that's all you need. You can then use the following code to retrieve the auth token and then then use that to return the feed data as a JSON object.

<?php

function fetchUrl($url){

 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, $url);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 curl_setopt($ch, CURLOPT_TIMEOUT, 20);
 // You may need to add the line below
 // curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,false);

 $feedData = curl_exec($ch);
 curl_close($ch); 

 return $feedData;

}

$profile_id = "the_profile_id_of_the_page_you_want";

//App Info, needed for Auth
$app_id = "your_app_id_in_here";
$app_secret = "your_app_secret_in_here";

//Retrieve auth token
$authToken = fetchUrl("https://graph.facebook.com/oauth/access_token?grant_type=client_credentials&client_id={$app_id}&client_secret={$app_secret}");

$json_object = fetchUrl("https://graph.facebook.com/{$profile_id}/feed?{$authToken}");

Thanks to an edit someone suggested I reckon this code came from here (looks familiar anyway :) ) and there's some more info in the comments there that might help.

You can then parse the object, here's some code to do it in PHP based on this thread;

Handling data in a PHP JSON Object

$feedarray = json_decode($json_object);

foreach ( $feedarray->data as $feed_data )
{
    echo "<h2>{$feed_data->name}</h2><br />";
    echo "{$feed_data->message}<br /><br />";
}

To find out what's available to you in the json object you can output the url in a browser and copy/paste it into this useful json visualisation tool;

http://chris.photobooks.com/json/default.htm

Solution 2

Facebook app access token doesn't ever expire or change unless I manually reset the secret

That's correct.

App tokens do not expire unless the App Secret is reset. App access tokens are unique to each app.

Since public feeds take any valid access token, application tokens can be used.

Go to https://developers.facebook.com/tools/access_token and you would not require a flow. Then you can just hard code it in. The moment you reset the secret this method is void.

$access_token = '1111111111|2Cha_1-n5'
$graph_url = "https://graph.facebook.com/Boo/posts?access_token=" 
    . $access_token;
$page_posts = json_decode(file_get_contents($graph_url), true);

Then iterate through the pages

foreach($page_posts['data'] as $post){
    $post_link = $post['actions'][0]['link'];
    $page_id = $post['from']['id'];
    $page_name = $post['from']['name'];
    $message = ($post['message']) ? $post['message'] : " ";
    $name = ($post['name']) ? $post['name'] : " ";
    $story = ($post['story']) ? $post['story'] : " ";
    $post_time = $post['updated_time'];
}

_{Source: http://philippeharewood.com/facebook/how-to-get-facebook-access-tokens-in-php-for-public-posts-the-basic-sauce/}

Solution 3

In response to the message of @Psyked and @James_David_Low, it is not recommended to use FQL because is deprecated.

"...There are two low-level HTTP APIs that are also used at Facebook to access the graph: FQL and the Legacy REST API. These APIs contain similar and overlapping functionality, but are deprecated."

New features are generally only available in the Graph API. To future-proof your app you should be using the Graph API in your app if you can.

Solution 4

The accepted answer does not provide a dynamic way of retrieving the profileId/pageId or even explain how to retrieve it. Check out my answer/question. From my experience, the accepted answer is also wrong in requiring the curly braces around the app-id and app-secret. I got an error when I included those and it worked with them out.

It doesn't get any simpler than this.

View more solutions

Comments

[Adam Nuttall]

When I attempt to retrieve the $authToken I receive the response: "Missing redirect_uri parameter." Any ideas?

[McNab]

Is that what gets returned when you just put the url for the authToken part (minus curly braces, replacing variable names with your keys) straight into the browser address bar?

[Adam Nuttall]

Sorry, figured this out... I c&p'd your example and the URL is missing the '?' between access_token & type.

[McNab]

Good to know! You had me panicking there, checking my sites out and thinking 'Please tell me they've not changed it AGAIN already!!!'. :)

[Adam Nuttall]

I know that feeling... :-) Thanks for your valuable help.

[McNab]

Thanks and well spotted re the ? - don't know how that happened, have amended it. Cheers

[Adam Nuttall]

Annoyingly I ran through the exact same steps to retrieve a second Facebook page feed and receive an empty JSON data object.

[McNab]

I'm totally guessing here - maybe try setting up a new app for it??

[Efi MK]

Trying to run - https://graph.facebook.com/oauth/access_token?type=client_cr‌​ed&client_id=<1234>&‌​client_secret=<1qw2e‌​3e> Getting as a response access_token=123456|123456 then running https://graph.facebook.com/espn/feed?access_token=123456|123‌​456 and getting An access token is required... error. What am I doing wrong, should I enable something on my app page ?

[McNab]

You need to wrap the client_id and client_secret in braces {} as per the code example, you have used <>.

[CBroe]

That's not true, FQL itself is not deprecated. Using it via the RestAPI and some other older ways is deprecated - but making FQL queries using the Graph API endpoint is absolutely not deprecated.

[enguerran]

are they not changed it AGAIN already? I cannot figure out what is wrong with my try...

[McNab]

@enguerran - If you can't get this working can you try changing client_credentials to client_cred . This answer was edited recently and I haven't had a chance to verify it. If the edit is wrong I will roll it back, let me know if this works. Thanks.

[enguerran]

@McNab - It works like a charm! Thank you for your knowledges!

[enguerran]

@McNab - Could you tell me how fetchUrl() has to work? It doesn't on my web page copied/pasted from your answer. Edit It seems fetchUrl need this instruction: curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,false);

[McNab]

@enguerran - thanks for that tip, I've added it to the edit. I'm assuming that's based on PHP version on the server as it looks like it was added in cURL 7.10 - php.net/manual/en/function.curl-setopt.php

[Andrew Tibbetts]

That little access_token url is a gem!

[Andrew Lazarus]

s3.amazonaws.com/f.cl.ly/items/2G0q0y3Z2s32311U1s40/…

[And Finally]

Thank you thank you thank you! If only the Facebook API documentation were as straightforward as this!

[McNab]

You're welcome @AndFinally - I'm just glad this still works after 2 years! Cheers :)

[Jacek Pietal]

Diego's Right, CBroe's wrong: The FQL and REST APIs are no longer available in v2.1: Previously announced with v2.0, apps must migrate to versioned Graph API calls starting with v2.1. developers.facebook.com/docs/apps/changelog

[craned]

@McNab, Is this still a valid method of grabbing the access_token? When I try https://graph.facebook.com/oauth/access_token?type=client_cr‌​ed&client_id={id}&cl‌​ient_secret={secret}‌​, I get the error Invalid Client ID. Or do I just need to go further in setting the app up in Facebook?

[McNab]

@craned - yes it's still valid, it's still working on live sites, I've just checked. Something else must be amiss. Good luck with it!

[craned]

@McNab, Good to know. How far do I need to go in setting up the app on Facebook for it to work?

[craned]

@McNab, Did you have to submit your app to Facebook for review to view the posts? Nothing I do is letting my request for an access token work.

[McNab]

@craned - No, there was no review of the app or anything when I did it. I haven't done one for a while though. Sorry, I'm not sure what the problem is I'm afraid.

[craned]

I finally figured out what I was doing wrong. 2 things: 1) I wasn't using the full access_token returned by FB. 2) I had to take out the curly braces. They were giving me an 'Invalid Token' error.

[twan]

Great! This works, but how can I show an image from a post?

[McNab]

@twan - In the example above it's {$feed_data->picture} - you would just var_dump($feed_data); to find out what's available to you.

[twan]

@McNab I got the answer on how to do this here: stackoverflow.com/questions/37478053/… You can just add the fields in the url.

[Mark]

It looks like this no longer works with the tightening of permissions - existing apps may continue to work, but new apps require approval.