使用Facebook Graph API实现用户1向用户2主页发帖的问题排查

Hey there, let's work through why your attempt to post to User 2's Facebook Page via the Graph API isn't sticking. I've debugged dozens of these issues, so let's break down the most common pitfalls and fixes step by step:

1. Outdated or Incorrect Permissions #

First off, publish_actions has been deprecated since 2018—that's probably the biggest blocker here! To post to a Facebook Page, you need these modern, required permissions instead:

• pages_show_list: Lets the user access the list of Pages they manage
• pages_read_engagement: A prerequisite permission to read Page data before posting
• pages_manage_posts: The critical permission to create or edit posts on a Page

Important notes:

• These permissions need Facebook App Review if your app is public (not just in development mode). For testing, use test users who are assigned to your app and have admin/editor/publisher roles on User 2's Page.
• You can't use a regular user access token directly to post to a Page. You need to exchange the user's token for a Page Access Token (more on that below).

2. Wrong API Endpoint & Target ID #

A super common mistake is mixing up user IDs and Page IDs, or hitting the wrong endpoint:

• You must target the Page's unique ID, not User 2's personal user ID. Find the Page ID via the Page's settings or by calling the /{user-id}/accounts endpoint.
• The correct endpoint for posting to a Page's feed is POST /{page-id}/feed, not /{user-id}/feed (personal timelines have extremely restricted API access now, even for your own account).

3. App Configuration Missteps #

Let's double-check your app settings:

• Redirect URI: If this is a web app, using https://www.facebook.com/connect/login_success.html (a default for native/desktop apps) might cause token validation issues. Swap it for your own domain's redirect URI (e.g., https://yourdomain.com/auth/facebook/callback).
• App Type: If you're building a web app, don't set it to "Native or Desktop App"—switch to "Web App" in your app's basic settings. Mismatched app types can break token issuance entirely.
• Secret Key Security: Never embed your app secret in frontend code! All Graph API calls should run from your backend server—exposing the secret publicly will get your app flagged or blocked.

4. Invalid or Expired Access Token #

Even with the right permissions, a bad token will fail every time:

• Verify your token's validity, permissions, and expiration using the debug_token endpoint:

  GET /debug_token?input_token={your-access-token}&access_token={your-app-id}|{your-app-secret}
  

• Page Access Tokens have different expiration rules: Short-lived tokens last 1 hour, long-lived ones last 60 days. To get a long-lived Page token, first exchange the user's short-lived token for a long-lived user token, then swap that for a long-lived Page token.

Step-by-Step Correct Workflow #

Let's outline the proper flow to make this work reliably:

1. Confirm User 1 has an admin, editor, or publisher role on User 2's Page—no role = no posting permission, full stop.
2. Authenticate User 1 with the three required permissions (pages_show_list, pages_read_engagement, pages_manage_posts).
3. Call GET /{user-1-id}/accounts to retrieve all Pages User 1 manages—this response will include the valid Page Access Token for User 2's Page.
4. Use that Page Access Token to send a POST request to /{page-2-id}/feed with the message parameter (e.g., message=Hello from the Graph API!).
5. Check the API response for specific error codes—Facebook's error messages are very descriptive (e.g., #200 means permission issues, #803 means invalid Page ID).

内容的提问来源于stack exchange，提问作者Ido Sorozon