Hacker News Reader

I wish there was a way to request permissions for a given time period, it seems it's all or nothing. I'm creating some apps at the minute and just need to checkin the once, I wish I could communicate that to the user but instead facebook insists that they authorize it 'for ever' (well, until they remember and go and remove it).

In my opinion that would make take up and "throwaway" usage of apps a bit easier to sell.

View on HN

If you request offline_access, the user will see "access your data at any time" as a requested permission. If you do this, the access token you are given does not expire unless the user does some action to expire it (such as updating her password). If you don't do this, the access token has an expiration date, and the user has to refresh the session (transparently happens with the JS SDK, I believe) in order for you to have continued access.

Facebook API does have a method where you can revoke the permission automatically (ie when you no longer need it). And also if you don't request offline_access permission, the token is only valid for an hour or two. But yes, Facebook doesn't make this very clear to the user.

Reply on news.ycombinator.com