Blog

Facebook Graph API calls require access token for every request. To secure the APIs, Facebook has provided extra parameter appsecret_proof tothe API requests.

This setting must be enabled to require proof on all calls

The proof is generated automatically when using the Facebook SDK libraries.

The below NodeJS library can be used to generate the proof outside of the SDK library to work with any of the APIs

• Install CryptoJS library

  npm install crypto-js

• Using the access token and the app client secret, the appsecret_proof can be generated using the crypto js library as follows

  var CryptoJS = require("crypto-js");

  const accessToken = 'EWEWEWEWEWEWEWEWEWEWEWEWEWEWEWEWEWEW'
  const clientSecret = 'd01d01d01d01d01d01d01d01d01d01'
  const appsecretProof = CryptoJS.HmacSHA256(accessToken,   clientSecret).toString(CryptoJS.enc.Hex);

  console.log(appsecretProof);