there is an other way to do it still with oAuth v2, and this is described in the facebook docs, but splitted in several pages, so not easy to understand.
First, you need to activate the "OAuth 2.0 for Canvas" flag ine the "advanced parameters" of you app.
And then, here is a PHP example explaining how to handle it :
function parse_signed_request($signed_request, $secret) {
list($encoded_sig, $payload) = explode('.', $signed_request, 2);
// decode the data
$sig = base64_url_decode($encoded_sig);
$data = json_decode(base64_url_decode($payload), true);
if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') {
error_log('Unknown algorithm. Expected HMAC-SHA256');
return null;
}
// check sig
$expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
if ($sig !== $expected_sig) {
error_log('Bad Signed JSON signature!');
return null;
}
return $data;
}
function base64_url_decode($input) {
return base64_decode(strtr($input, '-_', '+/'));
}
$data = parse_signed_request($_REQUEST["signed_request"], <your facebook app api secret>);
if (empty($data["user_id"]) && !isset($_REQUEST['redir'])) {
// The user isn't authenticated
$auth_url = "http://www.facebook.com/dialog/oauth?client_id=" .
<your facebook app id> . "&redirect_uri=" .
urlencode('http://apps.facebook.com/<yourapp>/?redir=1');
echo("<script> top.location.href='" . $auth_url . "'</script>");
die;
}
// Here the user is authenticated
echo ("Welcome User: " . $data["user_id"]);
// And now you have the Graph API auth token in $data["oauth_token"],
// so you can use any graph api method
