Limited Login FAQ

In response to the upcoming changes to ATT enforcement, we made changes to the iOS SDK and the SDK no longer provides valid user access tokens in scenarios where the user opts out of ATT. The access token validation or Graph API requests may throw errors like OAuthException - “Invalid OAuth access token - Cannot parse access token”. Our recommendation is that users integrate Limited Login following the official documentation:

• Limited Login for iOS
• Limited Login for Unity

When users opt out of ATT, all Facebook Login traffic will be performed on the Limited Login domain. Limited Login does not support business permissions. Our recommendation is that developers integrate Limited Login following the official documentation. See limited login supported permissions in this document.

When users opt out of ATT, all Facebook Login traffic will be performed on the limited login domain via the in-app browser. Limited Login does not support fast app switch (that is, redirecting to fb app to login). See limitations section of the Limited Login for iOS document.

Please see the official documentation, Validating the Limited Login OIDC Token.

Please see key considerations for user_friends with Limited Login in the Permissions in Limited Login document.

We made changes both to the iOS SDK and our core login systems to support the privacy manifest requirements based on the upcoming App Transparency Tracking enforcement so that iOS users who have opted out of ATT are able to use FBLogin. As a result, we do not plan to release the privacy manifest as part of a minor update.

執行受限登入時，系統會驗證用戶的身份，並填充身份驗證憑證的共享實例。身份驗證調用的其他資料將用於填充共享用戶個人檔案實例的基本欄位。

由於沒有存取權限，圖表要求將會失敗。如要獲取存取權限，請重新使用傳統的登入方法（預設啟用追蹤功能），或使用已指明啟用追蹤功能的配置調用 FBSDKLoginManagerlogInFromViewController:configuration:completion:。請注意，執行此操作時，系統將會追蹤用戶。

To access the Graph API, you need an access token. Either reuse the classic login method (defaults tracking to enabled), or call FBSDKLoginManager logInFromViewController:configuration:completion: with a configuration that specifies that tracking is enabled. This will allow you obtain an access token that can be used for Graph API calls. Be aware that when you do this, users are tracked. Be aware that Limited Login safeguards are not supported in this context.

When you use Limited Login to request user_friends from a user, we provide you with a list of app scoped IDs (ASIDs) associated with the friends of the authorizing user, if the friends have also granted your app the user_friends permission. Depending on how you have implemented Limited Login, some of the ASIDs on this list may represent other users that have connected to your app using Limited Login. To ensure that Limited Login safeguards are maintained for such users, do not make Graph API calls using their ASIDs. Instead, continue to rely on Limited Login for these users.

是。登入按鈕新增了兩個公開屬性：

• loginTracking：可用於獲取或設定嘗試登入時的追蹤偏好設定。此項目將預設為 .enabled。

• nonce：可用於獲取或設定嘗試登入時所用的選用 nonce。有效的 nonce 必須為沒有空格的非空白字串。請注意：系統不會設定無效的 nonce。在這種情況下，系統會為登入嘗試使用預設的不重複 nounce。

從用戶角度來看，登出方式不會有任何變更。事實上，它會將現時的 AuthenticationToken、AccessToken 和 Profile 設定為 nil。

受限登入目前並不適用於 tvOS。

否，由於 SDK 9.0 版已停用 React Native SDK，因此我們不會為其開發受限登入功能。如需更多資訊，請參閱心情原生文件。

There is no impact to existing logged in users from adopting Limited Login in your app. If you would like to take advantage of Limited Login safeguards for existing, logged-in users, you must log them out by so they can log back in with Limited Login.

否，受限登入旗幟僅會針對特定裝置。

您可以使用電郵地址及/或 ASID 來調整這些用戶。

否，fb_login_id 在受限登入模式下仍然存在。在受限登入模式下，它是用於交換 OIDC 憑證的用戶存取憑證（獨立實體）。

受限登入模式僅支援基本個人檔案（姓名和相片）和電郵地址權限。如果您的應用程式需要企業權限，則無法使用受限登入來要求獲取它們。但是，您的用戶可以透過以下方式在傳統登入模式中授予企業權限：

• 透過網頁版登入您的應用程式。
• 在傳統登入模式下透過 iOS 登入您的應用程式。
• 透過 Android 登入您的應用程式。

Yes, but this will require the use of an app access token to request the token_for_business field on the User node. Limited Login safeguards are not supported in this context. For apps that are associated with your business by means of Business Manager, you can use the app-scoped ID (ASID) included in the OIDC token returned after a successful login to get a unique string for a user. Using your app's app access token, request the token_for_business field on the User node and pass in the user's app-scoped ID. This call returns a string which is the same for this user across all the apps managed by the same Business Manager.

GET /ASID?fields=token_for_business

This returns the values.

{
  "id": "1234567890"
  "token_for_business": "weg23ro87gfewblwjef"
}

Usage notes:

• The person being queried must have logged into this app.
• If the owning business changes, the value of token_for_business will also change
• If you request the token_for_business field and the app is not associated with a Business Manager, the call returns an error.
• The value returned by token_for_business is a token, not an ID - it cannot be used directly against the Graph API to access a person's information. You should still store the ID in your database.