The accessToken generated by SDK 17.0.0 is Invalid: `Invalid OAuth access token - Cannot parse access token `

[alwayswith]

Checklist before submitting a bug report

• [X] I've updated to the latest released version of the SDK
• [X] I've searched for existing GitHub issues
• [X] I've looked for existing answers on Stack Overflow, the Facebook Developer Community Forum and the Facebook Developers Group
• [X] I've read the Code of Conduct
• [X] This issue is not security related and can safely be disclosed publicly on GitHub

Xcode version

15.2

Facebook iOS SDK version

17.0.0

Dependency Manager

SPM

SDK Framework

Login

Goals

I had upgrade the sdk to 17.0.0, but access token generated by the sdk is invalid. I used the Graph API Explorer to debug the access token, It reports error. When I downgrade the sdk verstion to 16.3.1, the access token is valid.

Expected results

{ "id": "123456", "name": "Zac" }

Actual results

{ "error": { "message": "Invalid OAuth access token - Cannot parse access token", "type": "OAuthException", "code": 190, "fbtrace_id": "A5WdWSSFlOkAu4p8C-qJGqR" } }

Steps to reproduce

No response

Code samples & details

// get the access token
  let loginButton = FBLoginButton()
        loginButton.center = view.center
        view.addSubview(loginButton)
        
        DispatchQueue.main.asyncAfter(deadline: .now() + 3) {
            if let token = AccessToken.current,
                !token.isExpired {
                print(token.tokenString)
            }
            // your code here
        }

[y2ducky]

I've encountered the same issue (I'm using Cocoapods). When using version 16.3.1, there are no errors, but upon upgrading to 17.0.0, I receive the "Invalid OAuth access token - Cannot parse access token" error when verifying the token in my server. In my testing, I've noticed that the tokenString value in version 17.0.0 is one character shorter than when testing with version 16.3.1. I'm not certain if this is related to the problem, but I thought it worth sharing.

• Updated: I have realized that it was intended behavior in version v17.0.0 and I resolved it by switching to the Limited Login method, which uses a JWT authentication token.

[KovtunOleg]

Debug-Token api will also fail with the same error for access tokens generated with iOS v17.0.0.

[jiwooong]

I've encountered the same issue. when using v16.3.1, there are no errors, but after update v17.0.0 I receive the same error. "Invalid OAuth access token - Cannot parse access token"

[HaejungAhn]

same here🥲

[goleoh]

Same. But it happened only at the M2 machines like a macbook pro. And I didn't use the limited login, but the browser opens for limited login. The url is like "limited.facebook.com". At the old facebook sdk, the opened url is like "m.facebook.com/".

And the returned token doesn't begin with "GG". Our app is a game, and the access tokens begin with "GG" usually.

[cxxer]

Same. But it happened only at the M2 machines like a macbook pro. And I didn't use the limited login, but the browser opens for limited login. The url is like "limited.facebook.com". At the old facebook sdk, the opened url is like "m.facebook.com/".

And the returned token doesn't begin with "GG". Our app is a game, and the access tokens begin with "GG" usually.

same. And there is no button that can be used to jump to the FB client.

[deepmode]

These are what I discover when using version 17.0.0 SDK with iOS 17+ With AppTracking Transparency enable for your App -> receive a valid FB AccessToken With AppTracking Transparency disable for your App -> receive an invalid FB AccessToken

[zimssa-mkkim]

These are what I discover when using version 17.0.0 SDK with iOS 17+ With AppTracking Transparency enable for your App -> receive a valid FB AccessToken With AppTracking Transparency disable for your App -> receive an invalid FB AccessToken

we have the exact same issue

[goleoh]

I resolved this issue. The FB SDK 17.0 uses a limited login forcefully in ios 17 when the ATT is not on. So we should impletemt limited logins. In the limited login, you cannot use the access token at the graph api in your web server. You can use the authentication token which is a JWT. You can verify it and extract user information from it. So you should handle the both tokens - normal access token on the ATT enabled and authentication token on the ATT not enabled. Or you can use the limited logins only and use authentication tokens.

[gonsee]

I have just found this announcement. https://developers.facebook.com/blog/post/2024/03/28/changes-made-to-fb-login-sdk/

[AGulev]

I have just found this announcement. https://developers.facebook.com/blog/post/2024/03/28/changes-made-to-fb-login-sdk/

We got the same problem, so it's by design (not a bug)? If so, this

I resolved this issue. The FB SDK 17.0 uses a limited login forcefully in ios 17 when the ATT is not on. So we should impletemt limited logins. In the limited login, you cannot use the access token at the graph api in your web server. You can use the authentication token which is a JWT. You can verify it and extract user information from it. So you should handle the both tokens - normal access token on the ATT enabled and authentication token on the ATT not enabled. Or you can use the limited logins only and use authentication tokens.

isn't a workaround but a proper solution for new SDK?

[beerana-meta]

Hello - We recently made changes to Facebook Login SDK for iOS. As a result of these changes, we recommend that you use Limited Login. If you are unable to implement Limited Login, the Graph API, iOS would need to be used to support these permissions. See more details here.

[jjw0722]

Hello - We recently made changes to Facebook Login SDK for iOS. As a result of these changes, we recommend that you use Limited Login. If you are unable to implement Limited Login, the Graph API, iOS would need to be used to support these permissions. See more details here.

Hello. then how to solve our problem? We validate access token using our web server after facebook login. but now our app can't validate JWT iOS 17 device because we don't integrate limited login yet.

So you mean after all, in a system like us that verifies tokens through a web server, you can't do it the way it is, but you have to integrate limited logins or manually adjust the graph API?

Additionally, if you look at the official Facebook guide document, there is an article below, and even if you use that method, it returns an invalid access token. Why is that?

"A graph request will fail because there is no access token. To get an access token, either reuse the classic login method (defaults tracking to enabled), or call FBSDKLoginManager logInFromViewController:configuration:completion: with a configuration that specifies that tracking is enabled. Be aware that when you do this, users are tracked."

[ByBogon]

Hello - We recently made changes to Facebook Login SDK for iOS. As a result of these changes, we recommend that you use Limited Login. If you are unable to implement Limited Login, the Graph API, iOS would need to be used to support these permissions. See more details here.

Hello. then how to solve our problem? We validate access token using our web server after facebook login. but now our app can't validate JWT iOS 17 device because we don't integrate limited login yet.

So you mean after all, in a system like us that verifies tokens through a web server, you can't do it the way it is, but you have to integrate limited logins or manually adjust the graph API?

Additionally, if you look at the official Facebook guide document, there is an article below, and even if you use that method, it returns an invalid access token. Why is that?

"A graph request will fail because there is no access token. To get an access token, either reuse the classic login method (defaults tracking to enabled), or call FBSDKLoginManager logInFromViewController:configuration:completion: with a configuration that specifies that tracking is enabled. Be aware that when you do this, users are tracked."

which means web server can't validate JWT IOS 17 device through Facebook api?

Is there some way for web server to validate JWT IOS 17 device through Facebook api? OR should web server just decode and verify JWT IOS 17 device (authentication token) by this doc?

[jjw0722]

Hello - We recently made changes to Facebook Login SDK for iOS. As a result of these changes, we recommend that you use Limited Login. If you are unable to implement Limited Login, the Graph API, iOS would need to be used to support these permissions. See more details here.

Hello. then how to solve our problem? We validate access token using our web server after facebook login. but now our app can't validate JWT iOS 17 device because we don't integrate limited login yet. So you mean after all, in a system like us that verifies tokens through a web server, you can't do it the way it is, but you have to integrate limited logins or manually adjust the graph API? Additionally, if you look at the official Facebook guide document, there is an article below, and even if you use that method, it returns an invalid access token. Why is that? "A graph request will fail because there is no access token. To get an access token, either reuse the classic login method (defaults tracking to enabled), or call FBSDKLoginManager logInFromViewController:configuration:completion: with a configuration that specifies that tracking is enabled. Be aware that when you do this, users are tracked."

which means web server can't validate JWT IOS 17 device through Facebook api?

Is there some way for web server to validate JWT IOS 17 device through Facebook api? OR should web server just decode and verify JWT IOS 17 device (authentication token) by this doc?

How to verify the Authentication Token on the web server is shown in the official guide document. What I said above is that the official guide document says that you can get an access token by setting the loginFromViewController API to tracking enabled as above, but even if you do that, you will return the invalid token and ask why.

You can get a JWT-type token from our web server and verify it, but I thought it could be solved by modifying the API without adding additional logic.

[ByBogon]

@jjw0722

Yep I got your point. Just wondered whether I can use graph api to verify JWT, which is impossible.

So just to triple check, when web server validates JWT, gotta follow what the doc says, right?

[davehpcnt]

Facebook JWT tokens are not cached when the app is closed. Is there a way to get the token without displaying the limited login screen on Facebook? FBSDKLoginKit.AccessToken.current?.tokenString -> nil?

[Yehsam23]

If ATT is not agreed upon, limited access will be imposed. Is there any way to retrieve the ID for business through JWT Token at this time?

[arkku]

Let's say I already have a nonce, how do I exchange it for a JWT token instead of the (broken) access_token?

[zimssa-mkkim]

When it's a limited login you can't use access token because graph api will not work with it. Instead, you can use FBSDK AuthenticationToken.currentAuthenticationToken and verify it with JWK verifiers.

[leonle69]

It's been over 3 weeks now and it hasn't been resolved. I am quite stressed about this issue. any idea how to resolve it?

[rgg-egunnery]

Has anyone gotten limited login to work with non tester accounts? Works fine for our test accounts but when trying to use it with public accounts, the new loginManager.logIn(configuration: configuration) just returns a cancellation. Not using anything that needs the app to be approved

[kevin-zqw]

When iOS ATT is disabled, even if I log in using the regular mode, the Facebook SDK will fall back to limited mode and return an invalid token.

Do you know how to determine if it's a limited login from the FBSDKLoginManagerLoginResult return result?

[mvpscottjon]

There two token in it

• one is accessToken which needs graphAPI to get user info

• another one is AuthenticationToken(aka JWT token) which needs JWT decode to get user info

If you use limit login, you only can get AuthenticationToken(Sorry I change to this. I said accessToken was wrong)

If you use enable tracking to login, you can get AuthenticationToken and accessToken(no matter ATT is enable or not...a little weird...)

[rgg-egunnery]

@mvpscottjon have you tried your .limited config with public accounts or just test accounts?

[mvpscottjon]

@mvpscottjon have you tried your .limited config with public accounts or just test accounts?

Yes, I also test using public accounts.

But I change my comment, is it right for you?

[alexwind-lin]

@mvpscottjon have you tried your .limited config with public accounts or just test accounts?

Yes, I also test using public accounts.

But I change my comment, is it right for you?

i can only get a cancelled result when using .limited on public accounts

[loving-irene]

There two token in it

• one is accessToken which needs graphAPI to get user info
• another one is AuthenticationToken(aka JWT token) which needs JWT decode to get user info

If you use limit login, you only can get AuthenticationToken(Sorry I change to this. I said accessToken was wrong)

If you use enable tracking to login, you can get AuthenticationToken and accessToken(no matter ATT is enable or not...a little weird...)

thanks,it's ok for me. test account is ok for limit config,and normal account also ok. but there is a strange question,one account isn't work you can try multiple account(test,normal,develop) if you have same question

[KeatoonMask]

I started using Limited Login as meta recommends.

After a successful login, the global AuthenticationToken instance is properly populated.

Later, I get the token of the auth response from the AuthenticationToken.current?.tokenString.

Everything looks good. When decoding such token, the info is correct but it has an invalid signature.

{
"error": {
"message": "Bad signature",
"type": "OAuthException",
"code": 190,
"fbtrace_id": "ArYahP8jTA10WI-HkYMWrno"
}
}

Any idea of what I'm missing?

[vyshakh]

I had similar issue, I tried to verify the jwt token using jwt and matching public key from https://www.facebook.com/.well-known/oauth/openid/jwks/ and it shows signature is valid. use the full json object as public key. { "kid": "ec11d50341c08e82899650e6afcc6668f2a0a420", // this should match with your jwt header kid "kty": "RSA", "alg": "RS256", ... } @KeatoonMask