Limited Login Data Refresh

<key>keychain-access-groups</key>
<array>
    <string>$(AppIdentifierPrefix)*</string>
</array>

• If direct fails for any reason other than featureDisabled — including notDPoPBound — the SDK falls back to silent. Silent re-binds the token, which is what recovers a notDPoPBound session.
• If silent then returns loginRequired or consentRequired, the SDK falls back to explicit.
• Transient failures such as networkError and timeout never escalate to explicit, so a connectivity blip does not present a login dialog.
• featureDisabled never cascades. If Data Refresh is unavailable, no path can succeed, so the SDK surfaces the error instead of presenting UI.

1. Add the SDK. With Swift Package Manager, add https://github.com/facebook/facebook-ios-sdk and the FacebookLogin product. With CocoaPods, add pod 'FBSDKLoginKit' and run pod install. Use 18.1.0 or later.
2. Add the keychain entitlement. Add a keychain-access-groups entry to your app’s .entitlements file, as shown in Requirements, and confirm the target has a valid DEVELOPMENT_TEAM. This is what enables silent, device-bound refresh.
3. Confirm Limited Login works first. Your app should already log people in with LoginConfiguration(permissions:tracking:nonce:) using .limited tracking, and Profile.current should be populated afterward.
4. Nothing to opt into for automatic refresh. Once Limited Login works and the entitlement is in place, foreground refresh is automatic. Use the on-demand API only when you want explicit control.

public func refreshLimitedLogin(
    from viewController: UIViewController? = nil,
    fallbackPolicy: RefreshFallbackPolicy = .automatic,
    completion: @escaping (Result<LimitedLoginRefreshResult, LimitedLoginRefreshError>) -> Void
)

import FBSDKLoginKit

LoginManager().refreshLimitedLogin(from: self) { result in
    switch result {
    case let .success(refresh):
        // refresh.profile, refresh.authenticationToken, and the
        // Profile.current / AuthenticationToken.current singletons are all current.
        print("Refreshed via .\(refresh.path.rawValue)")
    case let .failure(error):
        print("Refresh failed: \(error.localizedDescription)")
    }
}

public struct LimitedLoginRefreshResult {
    public let profile: Profile
    public let authenticationToken: AuthenticationToken
    public let path: RefreshPath
}

public enum RefreshPath: String {
    case direct    // the device-key-bound POST
    case silent    // prompt=none
    case explicit  // the standard Limited Login dialog
}

if let refreshDate = Profile.current?.refreshDate,
   Date().timeIntervalSince(refreshDate) > 3600 {
    LoginManager().refreshLimitedLogin { _ in }
}

import FBSDKCoreKit

// Refresh at most once every 6 hours.
Settings.shared.limitedLoginAutoRefreshInterval = 6 * 60 * 60

1. Import the SDK. Install Facebook SDK for Unity 18.1.0 or later (release notes⁠), then let the External Dependency Manager resolve native dependencies.
2. Configure Facebook login as usual. Set your app ID and client token in Facebook Settings, call FB.Init(), and confirm a normal Limited Login works first.
3. Enable Keychain Sharing on the generated iOS target, with a valid development team. This is what enables silent, device-bound refresh.
4. Optional — enable fast app switch for the initial login. By default the initial Limited Login runs through a web flow. To route it through a native app switch to the Facebook app, call FB.Mobile.SetFastAppSwitchEnabled(true) after FB.Init() and before the login call. This is iOS-only, and it affects the initial login, not RefreshLimitedLogin. The app switch happens only when the Facebook app is installed and the feature is enabled for your app; otherwise login falls back to the web flow.

FB.Mobile.RefreshLimitedLogin(
    FacebookDelegate<ILoginResult> callback = null,
    RefreshFallbackPolicy fallbackPolicy = RefreshFallbackPolicy.Automatic);

#if UNITY_IOS
FB.Mobile.RefreshLimitedLogin(OnRefresh, RefreshFallbackPolicy.Automatic);
#endif

void OnRefresh(ILoginResult result)
{
    if (!string.IsNullOrEmpty(result.Error)) { Debug.LogError(result.Error); return; }
    if (result.Cancelled) { return; }

    var profile = FB.Mobile.CurrentProfile();
}

• Missing keychain entitlement. If keychain-access-groups is absent or the team identifier is misconfigured, key generation fails at login, no thumbprint is sent, and the issued token lacks the claim. Add the entitlement, then log in again.
• Token issued before binding. A session created before the device key was bound does not carry the claim. Log in again.
• Device key wiped. Reinstalling the app clears the keychain key, so it no longer matches the token’s claim. Log in again.

• Limited Login
• Limited Login for iOS
• Limited Login for Unity
• Limited Login OIDC Token
• Permissions in Limited Login
• Limited Login FAQ