I have developing a restful api where the client provides a facebook user id (let say myapi/get_user/123) and the API must retrieve user's public information like name, birthday, etc. That it's done.
Current code:
$fb = new Facebook\Facebook([
'app_id' => $fbSettings['app_id'],
'app_secret' => $fbSettings['app_secret'],
'default_graph_version' => $fbSettings['default_graph_version']
]);
$token = 'EAAD...';
try {
// Returns a `Facebook\FacebookResponse` object
$fbResponse = $fb->get('/' . $request->getAttribute('id') . '?fields=link, name, birthday', $token);
} catch(Facebook\Exceptions\FacebookResponseException $e) {
return $response->withStatus(500)->withJson(['msg' => $e->getMessage()]);
exit;
}
$user = $fbResponse->getGraphUser();
return $response->withJson($user);
My problem it's that I don't know what is the best way to handle the access token. Should the token be provided by the client? In that case, should pass as param in the same request (e.g: myapi/get_user/123?token=ABC123) or should do another api call (let say myapi/register_token/ABC123) breaking the principle of being stateless.
I looking for the best way (or the best practice) to handle the access token.
