Facebook Login token refresh behavior during user password changes

Facebook Login Token Refresh During User Password Changes

Facebook Login for Websites issues short-lived access tokens (typically 1-2 hours) with refresh token mechanisms for extended sessions. The OAuth 2.0 implementation supports automatic token refresh when applications properly implement the refresh flow using the JavaScript SDK or server-side OAuth endpoints.

The unresolved behavior concerns what happens to existing access tokens and refresh tokens when a user changes their Facebook password through the standard account settings interface. While Facebook's documentation indicates tokens can be invalidated when users revoke app permissions, it's unclear whether password changes trigger automatic token invalidation for all connected applications or only those with specific permission scopes.

This creates uncertainty for implementing robust error handling in applications that maintain persistent user sessions. Applications need to determine whether to proactively refresh tokens, handle authentication failures gracefully, or implement specific recovery flows for this scenario.

The feature depends on registered applications with valid App ID and redirect URI configuration at developers.facebook.com, with access tokens subject to Facebook's platform availability and policy compliance requirements.

• Does Facebook automatically invalidate all access tokens when a user changes their password?
• Which specific Graph API permissions trigger token invalidation on password changes?
• What is the recommended error handling pattern for applications when this occurs?