You are definitely correct that using an outside storage location (a session variable, for example) is the wrong way.
The correct approach depends on whether or not you consider an error to be an exceptional circumstance. If not, then follow the example set in the framework by prefixing your function with the word Try and having its signature look like this:
public bool TryGetFacebookToken(, out string token)
{
... set the token within the body and return true if it succeeded or false if it did not
}
The important thing to note here is that this approach is generally used when you only care whether or not the operation worked (and you don't really care why it didn't work if it failed) and have a reasonable expectation that it may not.
If a failure is exceptional (meaning that a properly configured program should not encounter this error), then you should use an exception. In fact, if your function cannot actually do anything with the exception you're getting, then there's no point in actually catching it. Proper exception handling means letting the exception "bubble up" to whatever layer in your program can actually do something meaningful and appropriate with the exception.
This also simplifies your scenario, since you only need to return a string.
