AuthenticationToken

The AuthenticationToken class represents an authentication token received from iOS Limited Login. It wraps an OpenID Connect token that can be used to verify a user’s identity but cannot access the Graph API.

AuthenticationToken is iOS only and is used with Limited Login. For traditional login, use AccessToken instead.

Import

import { AuthenticationToken } from 'react-native-fbsdk-next';

Static Methods

getAuthenticationTokenIOS

Retrieves the current authentication token (iOS only).

static getAuthenticationTokenIOS(): Promise<AuthenticationToken | null>

Returns

Promise<AuthenticationToken | null> - Resolves with an AuthenticationToken instance if Limited Login was used, or null otherwise. Platform: iOS only (returns null on Android)

Example

import { AuthenticationToken } from 'react-native-fbsdk-next';
import { Platform } from 'react-native';

async function checkAuthToken() {
  if (Platform.OS !== 'ios') {
    console.log('Authentication tokens are iOS only');
    return;
  }
  
  const authToken = await AuthenticationToken.getAuthenticationTokenIOS();
  
  if (authToken) {
    console.log('Limited Login detected');
    console.log('Auth Token:', authToken.authenticationToken);
    console.log('Nonce:', authToken.nonce);
    console.log('Graph Domain:', authToken.graphDomain);
    
    // Send to your server for validation
    await validateTokenOnServer(authToken);
  } else {
    console.log('No authentication token (using traditional login)');
  }
}

import { Platform } from 'react-native';
import {
  AccessToken,
  AuthenticationToken,
} from 'react-native-fbsdk-next';

async function getLoginType() {
  if (Platform.OS === 'ios') {
    const authToken = await AuthenticationToken.getAuthenticationTokenIOS();
    if (authToken) {
      return 'limited';
    }
  }
  
  const accessToken = await AccessToken.getCurrentAccessToken();
  if (accessToken) {
    return 'traditional';
  }
  
  return 'not_logged_in';
}

const loginType = await getLoginType();
console.log('Login type:', loginType);

Instance Properties

The raw OpenID Connect token string from the authentication response.

authenticationToken: string

This token cannot be used to access the Facebook Graph API. Attempting to do so will result in an error: “Invalid OAuth access token - Cannot parse access token”

Example

const authToken = await AuthenticationToken.getAuthenticationTokenIOS();

if (authToken) {
  console.log('Token:', authToken.authenticationToken);
  
  // Send to your server for validation
  const response = await fetch('https://your-api.com/auth/facebook', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      token: authToken.authenticationToken,
      nonce: authToken.nonce,
    }),
  });
  
  const userData = await response.json();
  console.log('User verified:', userData);
}

nonce

The nonce from the decoded authentication response. Used for validating the authentication attempt.

nonce: string

The nonce is a unique string that prevents replay attacks. You should verify that this nonce matches the one you provided (or was generated) during login.

Example

import { AuthenticationToken } from 'react-native-fbsdk-next';

const authToken = await AuthenticationToken.getAuthenticationTokenIOS();

if (authToken) {
  console.log('Nonce:', authToken.nonce);
  
  // Verify nonce matches expected value
  const expectedNonce = await getStoredNonce();
  if (authToken.nonce !== expectedNonce) {
    console.error('Nonce mismatch - possible replay attack!');
    // Handle security issue
  }
}

graphDomain

The graph domain where the user is authenticated.

graphDomain: string

Typically this will be "facebook" for standard Facebook users.

Example

const authToken = await AuthenticationToken.getAuthenticationTokenIOS();

if (authToken) {
  console.log('Graph Domain:', authToken.graphDomain);
  // Usually: "facebook"
}

Types