为什么照片 API 需要公开照片的访问令牌？
照片 API 要求在请求公开可见照片时提供访问令牌。
但是，任何访问令牌都可以。因此，在此讨论区和其他讨论区中，建议开发人员只需使用自己的开发人员访问令牌和离线访问权限即可。显然这是不可取的，因为此访问令牌可能具有敏感权限，或者如果开发人员更改其 Facebook 密码，则可能会过期。
目前，我计划注册一个备用 Facebook 应用程序，并为自己生成一个基本访问令牌，仅授予 Offline_access 权限。对于使用单个访问令牌进行大量 API 调用或向公众公开此令牌，我应该担心什么吗？
The photos api requires an access token to be provided when making a request for publicly visible photos.
However, any access token will do. So on this discussion board and others, developers have been advised to simply use their own developer access token with offline_access permissions. Obviously this is undesirable since this access token may have sensitive permissions, or may expire if the developer changes their Facebook password.
Presently I am planning on registering an alternate Facebook application and generating a basic access token for myself with only the offline_access permission granted. Is there anything I should be concerned about in regards to making a very large number of API calls using a single access token, or by revealing this token to the public?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
Facebook 已将其所有 API 调用改为需要 access_token。这可能是为了他们可以限制速率并限制可能最终滥用其服务的应用程序。我不建议嵌入用户访问令牌，因为人们可以使用它并获取有关您帐户的信息。如果您不想嵌入开发人员帐户用户访问令牌，则许多调用可以使用应用程序设置页面上提供的应用程序令牌或传递以下格式的令牌：appId|appSecret
Facebook has been moving all of their API calls to requiring an access_token. This is probably so they can rate limit and restrict applications that may end up abusing their services. I wouldn't recommend embedding a user access token because people can take it and get information about your account. If you don't want to embed a developer account user access token, alot of the calls can use an application token available on your application settings page or by passing a token in this format: appId|appSecret