title: Facebook server-side authentication flow: is this the right "code?"
body: <p>I'm using FB.login on the JS client and want to verify the user's identity on the server.  So, the client gets a signedRequest from facebook and sends it to the server.  The server splits on the period, and decodes the second part of the signedRequest into a json object.</p>
  
  <p>What should I be using for "code" when I send my server-side request to </p>
  
  <pre><code>https://graph.facebook.com/oauth/access_token?
      client_id=YOUR_APP_ID
     &amp;redirect_uri=YOUR_REDIRECT_URI
     &amp;client_secret=YOUR_APP_SECRET
     &amp;code=CODE_GENERATED_BY_FACEBOOK
  </code></pre>
  
  <p>My decoded json looks something like:  </p>
  
  <pre><code>{"algorithm":"HMAC-SHA256","code":"2.AQCPA_yfx4JHpufjP.3600.1335646800.1-5702286|l11asGeDQTMo3MrMx3SC0PksALj6g","issued_at":1335642445,"user_id":"5232286"}
  </code></pre>
  
  <p>Is that the code I need?  Does it need to be B64 encoded?  If this isn't the code, what code should I use?</p>
  
  <p>_</p>
  
  <h2>What I've tried:</h2>
  
  <p>The request I'm trying to use is: </p>
  
  <pre><code>https://graph.facebook.com/oauth/access_token?client_id=295410083869479&amp;redirect_uri=https://squaredme.appspot.com/facebookredirect&amp;client_secret=44f1TOPSECRETbb8e&amp;code=2.AQCPA_yfx4JHpufjP.3600.1335646800.1-5702286|l11asGeDQTMo3MrMx3SC0PksALj6g
  </code></pre>
  
  <p>but this returns the error:</p>
  
  <pre><code>{"error":{"message":"Error validating verification code.","type":"OAuthException","code":100}}
  </code></pre>
  
  <p>I can't tell if this is because I'm using a bad code, or what.   Noteably, this is running on my local dev server, and squaredme.appspot.com definitely does NOT resolve to my IP.  I don't know if facebook checks that or what - I'm assuming I'd get a better error message.  Thanks for any direction!</p>