How can I get a permanent access token to post to a Facebook page that I own?
<p>I am the administrator of a Facebook Page. I am building a web app which, under certain circumstances, will post on Facebook as that Page.</p>

<p>With most APIs, I would just get an API key, and supply that when connecting to the API from my app. But Facebook expects an access token instead of an API key. (Specifically, in this case, it needs a "page access token".)</p>

<p>I am trying to figure out how to get a page access token that will be as <strong>permanent</strong> as possible.</p>

<p>After jumping through a bunch of esoteric, undocumented hoops (see <a href="http://www.spacecatsamba.com/posts/setting-up-permissions-and-obtaining-a-page-access-token-for-facebook-api-usage" rel="nofollow noreferrer">here</a> and <a href="https://stackoverflow.com/a/28418469/3311358">here</a>) in order to get a token that wouldn't expire, I had this working. When I ran the token through <a href="https://developers.facebook.com/tools/debug/accesstoken" rel="nofollow noreferrer">Facebook's Access Token Debugger</a>, the "Expires" field read "Never". All was good in the world.</p>

<p>But, the next day, my token became invalid anyway. The Access Token Debugger, and my app's calls to Facebook's PHP SDK, both started returning this error:</p>

<blockquote>
  <p>Error validating access token: Session does not match current stored session. This may be because the user changed the password since the time the session was created or Facebook has changed the session for security reasons.</p>
</blockquote>

<p>It seems that a token can become invalid for <a href="https://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/" rel="nofollow noreferrer">a variety of reasons</a> (but this article is five years old, so who knows – Facebook changes things every two weeks). I had not changed my password. (I might have logged out of Facebook, though.) Facebook offers no specifics about why this particular token might have become invalid.</p>

<p>I've also seen a few references to a permission called <code>offline_access</code>, but <a href="https://developers.facebook.com/docs/roadmap/completed-changes/offline-access-removal" rel="nofollow noreferrer">Facebook seems to have removed this</a>.</p>

<p>I suppose my question is twofold:</p>

<ol>
<li><p>In general, I've found Facebook token authentication to be incredibly brittle when calling the Facebook API from the server. The token system seems to be designed mainly to allow <em>other users</em> to grant (or revoke) various kinds of account access to <em>my apps</em>. But that's not what I'm doing – I'm trying to get a token that will let <em>me</em> post to a page that <em>I</em> own. And for that scenario, Facebook's aggressive invalidation of tokens becomes a serious liability. I can't launch my app if my access token (and therefore my Facebook integration) could randomly stop working at any moment, requiring me to generate a new token and update the app. <strong>This seems absurd. Is there an alternative method of authenticating to Facebook for my purposes?</strong></p></li>
<li><p>If a page access token is, in fact, the best way to authenticate my app to Facebook in order to post as my Page: <strong>how can I ensure that my token doesn't spontaneously become invalid</strong>?</p></li>
</ol>

<p>I hate developing for Facebook :/ Thanks for any insight you can offer.</p>