How do you get long-lived access tokens from the Facebook Graph API (server-side auth)?

Question

Since Facebook is removing the offline_access permission, I want to go ahead an migrate our website to use the new system.

I found this document on Facebook's website: https://developers.facebook.com/roadmap/offline-access-removal

However, when I process someone with Server-Side authentication, I get this response:

access_token => BLAHBLAHBLAHdontusemytokensilly
expires => 4992

When I try and use the acces point (on that document) to extend the access token more than a couple hours, I get this back:

access_token => BLAHBLAHBLAHdontusemytokensilly
expires => 4990

According to that document, server-side OAuth should get a token that lasts 60 days, I don't understand why I'm not getting that back.

I really do not want to send our users throught the OAuth redirect every 2 hours.

Any ideas? thanks!

UPDATE

As requested, here is the flow that I'm taking (in the browser):

First I redirected the user here:

https://www.facebook.com/dialog/oauth?client_id=BLAHBLAH&redirect_uri=http%3A//localhost/user-social/facebook/redirect&scope=user_about_me%2Cuser_events%2Cuser_interests%2Cuser_likes%2Cfriends_likes%2Cuser_location%2Cuser_status%2Cuser_subscriptions%2Cfriends_subscriptions%2Cemail%2Ccreate_event%2Cpublish_stream%2Crsvp_event%2Cpublish_actions%2Cuser_actions.music%2Cfriends_actions.music%2Cuser_actions.news%2Cfriends_actions.news%2Cuser_actions.video%2Cfriends_actions.video%2Cmanage_pages

This redirects the user to here:

http://localhost/user-social/facebook/redirect?code=BLAHBLAHBLAHsomeawesomecode#_=_

Then I requested an access token like so:

https://graph.facebook.com/oauth/access_token?client_id=BLAHBLAH&redirect_uri=http%3A//localhost/user-social/facebook/redirect&client_secret=BLAHBLAHsomeawesomesecret&code=BLAHBLAHBLAHsomeawesomecode

I receive this repose from Facebook:

access_token=BLAHBLAHBLAHdontusemytokensilly&expires=4057

This is obviosly a short-lived token. According to the Facebook documentation (above), I should have received a long-lived token (since I'm using server-side OAuth).

However, since it is short-lived, I attempted to trade it for a long-lived token:

https://graph.facebook.com/oauth/access_token?client_id=BLAHBLAH&redirect_uri=http%3A//localhost/user-social/facebook/redirect&client_secret=BLAHBLAHsomeawesomesecret&grant_type=fb_exchange_token&fb_exchange_token=BLAHBLAHBLAHdontusemytokensilly

This is what Facebook returned:

access_token=BLAHBLAHBLAHdontusemytokensilly&expires=3967

The same access_token is being returned in both requests.

UPDATE 2

I put the above access token into the Facebook Debugger and this is what it returned:

App ID: 
BLAHBLAH
User ID:    
211800900 : David Barratt
Issued: 
Unknown
Expires:    
1347303600 (in 40 minutes)
Valid:  True
Origin: Web
Scopes: create_event create_note email friends_actions.music friends_actions.news friends_actions.video friends_likes friends_subscriptions manage_pages photo_upload publish_actions publish_stream rsvp_event share_item status_update user_about_me user_actions.music user_actions.news user_actions.video user_events user_interests user_likes user_location user_status user_subscriptions video_upload

UPDATE 3

After deleting all of my permissions and re-authorizing the app (as @phwd suggested). The Facebook API returns this:

access_token=BLAHBLAHBLAHdontusemytokensilly

Does this mean that I've been returned the long-lived access_token? if so, where is the expiration?

UPDATE 4

When I run the above access_token through the Facebook Debugger, I get the following result:

App ID: 
BLAHBLAH
User ID:    
211800900 : David Barratt
Issued: 
1347309538 (39 minutes ago)
Expires:    
Never
Valid:  True
Origin: Web
Scopes: create_event create_note email friends_actions.music friends_actions.news friends_actions.video friends_likes friends_subscriptions manage_pages photo_upload publish_actions publish_stream rsvp_event share_item status_update user_about_me user_actions.music user_actions.news user_actions.video user_events user_interests user_likes user_location user_status user_subscriptions video_upload

This seems to fix the original problem, but it's strange that the access_tokens are indefinite instead of lasting the prescribed 60 days.

Any ideas on why that might be the case?

Answer 1

Not sure if you know it. But the access token will only be renewed once a day, no matter how many times the user logs in into your application.

See: https://developers.facebook.com/roadmap/offline-access-removal/

Answer 2

Since Facebook is removing the offline_access permission, I want to go ahead an migrate our website to use the new system.

Ensure you enabled "Remove offline_access permission" in the advanced settings of your app

If you did, you might be hitting a bug https://developers.facebook.com/bugs/378106708911903