According to the documentation the endpoint looks like
GET /debug_token?
input_token={input-token}&
access_token={access-token}
w
OK, so if one needs an app access token, app_id|app_secret
(both values concatenated with a pipe symbol in the middle) always works.
The method getApplicationAccessToken
seems to have been protected in the PHP SDK up to 3.2.2 – whereas getAppId
and getAppSecret
are already public in that version; so those could be the alternative to hard-coding id and secret in place.
The PHP SDK has the getOAuth2Client()
client method, that returns a \Facebook\Authentication\OAuth2Client
instance.
This has the debugToken($accessToken)
method, that returns a \Facebook\Authentication\AccessTokenMetadata
instance that contains data about the access token.
$appid = '123456789';
$appsecret = 'foobar';
$api = new Facebook(['app_id' => $appid, 'app_secret' => $appsecret]);
$oauth = $api->getOAuth2Client();
$meta = $oauth->debugToken($accessToken);
$meta->validateAppId($appid); // Will throw a FacebookSDKException if invalid
$meta->getIsValid(); // boolean
$meta->getExpiresAt(); // \DateTime|null