Why Facebook Access Token Changed Each and Every Access?

Question

We are using restFB 1.6.12. I am getting the facebook access token in two ways,

1. CLIENT_APP_ID = "XXXXXXXXXXXXXXXXXX"; 
   CLIENT_SECRET = "XXXXXXXXXXXXXXXXXX"; 
   REDIRECT_URL  = "XXXXXXXXXXXXXXXXXX";
   AUTH_CODE = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"; 
   SCOPE = "email,read_stream";

    Redirect to facebook as the example. As a result I'll get an
    authorization code  
    https://www.facebook.com/dialog/oauth?client_id=YOUR_APP_ID&redirect_uri=YOUR_URL&scope=email,read_stream

    asking for an access_token using,

    https://graph.facebook.com/oauth/access_token?client_id=YOUR_APP_ID&redirect_uri=YOUR_URL&client_secret=YOUR_APP_SECRET&code=THE_CODE_FROM_ABOVE

    this returns the access token like this,

    access_token=CAAHWfjdHDKcBAIL0zHMeJKzJw8Ug7WrrrkNxpBnK7ubnFR1RGtIIZA7T3UPlhCSV0hPJXZAgTcKfBSfHZAyxsndc3RT72XMREjACxnGb0ZCGMZAUgDWH3FgOhnaoSBMgkaQBPDOCCEKcLnznMYSncWS7dVxl9IFrSzeFjF6LKOWB3NTynl5X1&expires=5125218

 2. AccessToken accessToken = new
    DefaultFacebookClient().obtainAppAccessToken(appid,appsecret);
    String token=accessToken.getAccessToken();

    It reurns the access token like this,

    access_token=517312558337191|5oHY9T3cZICO_TCeK8OdXKg5Y08

If I use the first(1) one, it works fine for first access after then every access throws an error

Auth Token= {"error":{"message":"This authorization code has been used.","type":"OAuthException","code":100}}

If I use the second(2) one, it works fine only for publicSearchMessages but when I access publicEvents or other searches it throws an error

com.restfb.exception.FacebookOAuthException: Received Facebook error response of type OAuthException: (#200) Must have a valid access_token to access this endpoint
    at com.restfb.DefaultFacebookClient$DefaultGraphFacebookExceptionMapper.exceptionForTypeAndMessage(DefaultFacebookClient.java:766)
    at com.restfb.DefaultFacebookClient.throwFacebookResponseStatusExceptionIfNecessary(DefaultFacebookClient.java:688)
    at com.restfb.DefaultFacebookClient.makeRequestAndProcessResponse(DefaultFacebookClient.java:630)
    at com.restfb.DefaultFacebookClient.makeRequest(DefaultFacebookClient.java:592)
    at com.restfb.DefaultFacebookClient.makeRequest(DefaultFacebookClient.java:556)
    at com.restfb.DefaultFacebookClient.fetchConnection(DefaultFacebookClient.java:219)

My question is, what is the difference between these two access token and how can I programmatically generate access code for first one to works publicSearchMessages, getPublicEvents and other searches?

Which one access token is used to works as expected?

Answer 1

Access_tokens allow users to interact with your apps in secure and social ways. While we are removing the use of the offline_access permission, through a migration setting in the App Dashboard, we are now allowing the option to use access_tokens with a long-lived expiration time that can be renewed each time the user revisits your app

When a user visits your site with an existing, valid, short-lived user access_token, you have the option to extend the expiration time of that access token. extend the expiration time once per day, so even if a user revisits your site multiple times a day, the token will be extended the first time requested. You must make sure to call the new endpoint below before the short-lived access_token expires. Using the new endpoint below, you will be able to extend the expiration time of an existing, non-expired, short-lived user access_token.

To get the long-lived user access_token simply pass your own client_id (your app_id), your app_secret, and the non-expired, short-lived access_token to the endpoint. You will be returned a new long-lived user access_token; this access_token will exist in addition to the short-lived access_token that was passed into the endpoint

In short Get a page access token – those don’t expire per default; and make sure to do so with a long-time user access token

You can access facebook doc here for more info

To get an extended Page Access Token, exchange the User Access Token for a long-lived one and then request the Page token. This "extended" token for Pages will actually not have any expiry time.

https://developers.facebook.com/docs/howtos/login/extending-tokens/#step1

resolve this by executing a curl request, and saving "Page access token" in your code manually