Facebook login to existing user database, and access tokens
<p>Trying to add facebook login to an existing login system on a project I am working on. Built with angular, using the FB JS SDK. This is primarily to allow frictionless login, and not currently that fussed about using the access tokens to make further calls with the FB API.</p>

<p>So as a new user, they hit the FB login, accept permissions etc, and it fires me back an access token etc. The new user is created in my DB, along with the <code>accesstoken</code>, FB <code>userid</code>, etc.</p>

<p>How do I now authenticate the user with the <code>userid</code> and <code>accesstoken</code> now stored in my DB? As far as I can see, the access token changes on virtually every page load / request, so next time the user hits the FB login, or I check the FB login status the only constant thing I have is the <code>userid</code>.</p>

<p>Have done various reading on SO and FB docs eg:</p>

<p><a href="https://developers.facebook.com/docs/facebook-login/web" rel="nofollow noreferrer">https://developers.facebook.com/docs/facebook-login/web</a>
<a href="https://developers.facebook.com/docs/facebook-login/multiple-providers" rel="nofollow noreferrer">https://developers.facebook.com/docs/facebook-login/multiple-providers</a>
<a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow#checktoken" rel="nofollow noreferrer">https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow#checktoken</a></p>

<p><a href="https://stackoverflow.com/questions/27294165/how-should-a-facebook-user-access-token-be-consumed-on-the-server-side">How should a Facebook user access token be consumed on the server-side?</a></p>

<p>... although that has only served to confuse things further.</p>

<p>I imagine I would take that stored <code>accesstoken</code> then check its validity, however due to the various instances of access tokens expiring and being invalidated, this also seems like an incomplete solution.</p>

<p><strong>So my question:</strong> How do I securely authenticate my FB users with their counterpart user in my own DB?</p>