A user access token is required to request this resource

Question

I've developed a Facebookapp that has the "user_photos" permission. Now i've submitted the App, which is now live. I've installed it on several Facebook-Accounts of my friends... (Yes! they have granted the requested permissions)

When i now try to make an request i get the following error message

{ "error": { "message": "A user access token is required to request this resource.", "type": "OAuthException", "code": 102 } }

Here's my Request-Query: https://graph.facebook.com/LogInIDOfMyFriendThatHasInstalledTheAPP/?fields=albums.fields(photos,name,description),email&access_token=mySecretAppToken

Ok it works if I replace the App-Token with a User-Token that is generated by an OAuth-Process or via GraphAPIExplorer but in the Documentation (https://developers.facebook.com/docs/facebook-login/access-tokens/) it is said (in Paragraph) "App Tokens" that "App access tokens are used to make requests to Facebook APIs on behalf of an app rather than a user. [...]" and that i have to generate an other "App Accesstoken" but this also does't work.

I'm confused...

So is there something i've forgotten / missunderstood or do I have to use the oAuth-Way which means that my friends have to reauthenticate to my App every two month???

Thanks a lot!

Best regards Mike

Answer 1

A few lines after in the documentation it states

App access tokens can also be used to publish content to Facebook on behalf of a person who has granted a publishing permission to your application.

This is what they mean by requests on behalf of the user.

For the albums endpoint you need a user access token.

Yes your friends need to re-authenticate your app every two months if you extend a short lived user access token. The point is not to have apps sitting around with access when the user may have forgotten them. Prompting the user to re-authenticate ensures they are still aware of these apps and can have the choice to keep or delete them