Php-graph-sdk: Error: Graph returned an error: Invalid appsecret_proof provided in the API argument

[robksawyer]

I keep getting the following error when using this library. More details below.

composer.json = "facebook/php-sdk-v4": "^5.1",

$fb = new Facebook\Facebook([
            'app_id' => Configure::read('Facebook.appId'),
            'app_secret' => Configure::read('Facebook.secret'),
            'default_graph_version' => Configure::read('Facebook.version') //'v2.4'
        ]);

$response = $fb->get('/me?fields=id,email',$accessToken);

Error: Graph returned an error: Invalid appsecret_proof provided in the API argument 

Note: I'm trying to pass the accessToken from my Ionic mobile app. And then I'm validating the accessToken by making a Facebook API call to retrieve the email address. If the email address matches the one that was passed, then the request is valid. Another note, I've made sure to request public_profile and email when gaining the accessToken on the mobile side. And it works fine on the mobile side, returns the proper email and all.

Is there a better way to handle this?

[SammyK]

The app ID & secret must be the same for your mobile app as it is for your web app.

[jerryladoo]

@SammyK I was getting same error as well when I explicitly specified a page access token instead of default one, |.

the way calling the API looks similar to the following:

$this->facebook = new Facebook([
            'app_id' => $appId,
            'app_secret' => $appSecret,
            "default_access_token" => "<appid>|<appsecret>",
            "enable_beta_mode" => false,                    // should always be false, don't use any beta version of graph api unless necessary
            'default_graph_version' => 'v2.5'
        ]);
...

        $this->request = new FacebookRequest(
            $this->facebook->getApp(),
            <page access token>,  // <- this is page access token obtained from Graph API Explorer
            $method,
            $endpoint,
            $params,
            $eTag,
            $this->facebook->getDefaultGraphVersion() // <- v2.5
        );

        return $this->facebook->getClient()->sendRequest($this->request);

any idea? did I miss something?

[michael-delle]

I am also getting this error

[shimokei53]

Although I commented out this line and tentatively resolved this, I think it is wrong way.

https://github.com/facebook/facebook-php-sdk-v4/blob/master/src%2FFacebook%2FFacebookRequest.php#L472

        $accessToken = $this->getAccessToken();
        if ($accessToken) {
            $params['access_token'] = $accessToken;
            // $params['appsecret_proof'] = $this->getAppSecretProof();
        }

[FlorianKromer]

Hello, I am also getting this error, any ideas?
"facebook/php-sdk-v4": "^5.1" too

[SammyK]

If you're getting this error, make sure that your app ID and secret are exactly as they are in your app settings. You can dump the app ID and secret from the SDK like this:

var_dump($fb->getApp()->getId(), $fb->getApp()->getSecret());

Sometimes when you copy/paste the first or last few characters can get truncated. :)

Also it's not a good idea to disable the app secret proof since it provides a lot more extra security when you require it for your app. It prevents attackers from using any leaked access tokens when they don't have your app secret.

[SammyK]

If you're still having issues with this, feel free to chime back in. :)

[psedik]

I am also having this issue. My problem is, that I am getting the permanent page access token from other party, so it doesn't correspond with my appid/appsecret. Can I still use this SDK to download Page Insights, for example? From Graph API exlorer, I can do it... There, I am only getting an orange warning triangle, that the token isn't mine, but other than that, it works. Using SDK, I am getting the error mentioned in the title.

[SammyK]

@psedik The PHP SDK generates an appsecret_proof based on the app secret and access token. If you're using an access token that wasn't generated using your app, it won't pass the appsecret_proof check since the app secrets will be different. There's not a way to disable the appsecret_proof in the PHP SDK from the configuration. Hope that helps! :)

[yourchoice]

Hi,
I am also having this issue.

I checked var_dump($fb->getApp()->getId(), $fb->getApp()->getSecret()); and these are ok.

[kepner03]

Hi,
I had the same problem. Regarding the comment from SammyK "If you're using an access token that wasn't generated using your app, it won't pass the appsecret_proof check since the app secrets will be different. "
I have checked, how to get an access_token via the PHP API and NOT from the https://developers.facebook.com/tools/explorer/ . I guess the problem is that most of the developers tries with the access_token from the explorer, but as SammyK mentioned it won't work.
My sample for the right usage without disabling the appsecret_proof :
This should return your facebook id and name:

<?php
define('FACEBOOK_SDK_V4_SRC_DIR', __DIR__ . '/Facebook');
require_once __DIR__ . '/Facebook/autoload.php';

use Facebook\FacebookRequest;

$app_id = {{your app-id}};
$app_secret = {{your app-secret}};

$fb = new Facebook\Facebook([
  'app_id' => $app_id,
  'app_secret' => $app_secret,
  'default_graph_version' => '{{your app-version}}', 
  ]);

$token = $fb->get(
    '/oauth/access_token?client_id=' . $app_id . '&'.
    'client_secret=' . $app_secret . '&'.
    'grant_type=client_credentials');

$get_token = $token -> getdecodedBody();
$access_token = $get_token['access_token'];

try {
  // Returns a `Facebook\FacebookResponse` object
  $response = $fb->get('/{{your facebook name}}', $access_token);
} catch(Facebook\Exceptions\FacebookResponseException $e) {
  echo 'Graph returned an error: ' . $e->getMessage();
  exit;
} catch(Facebook\Exceptions\FacebookSDKException $e) {
  echo 'Facebook SDK returned an error: ' . $e->getMessage();
  exit;
}

$body = $response->getBody();

print_r($body);
?>

[koushik72]

You need to generate the access_token using your app.
When you generate access token, maybe you're generating it using Graph Api Explorer.

[tinonetic]

Hi

Using the solution posted @kepner03, I am getting the error:

You must provide an access token

...on the line with

$token = $fb->get(
    '/oauth/access_token?client_id=' . $app_id . '&'.
    'client_secret=' . $app_secret . '&'.
    'grant_type=client_credentials');

I am using it as is and am stuck on how to get it to work.

I am using API version 2.9 and I'm trying to post to a page using an App

[verchenko1985]

try app_id & secret = null
only access_token