title: Facebook: "This authorization code has been used.","type":"OAuthException","code":100
body: <p>I just upgraded to PHP 5.4.19 and facebook-php-sdk-v4. </p>
  
  <p>Is it just me or has FB made the integration deliberately difficult?! For instance, I don't use Composer (can't install it on my shared host) so loading the new classes required a specific (discover-for-yourself) ordering - that was enough headache! The suggested solution at <a href="http://metah.ch/blog/2014/05/facebook-sdk-4-0-0-for-php-a-working-sample-to-get-started/" rel="noreferrer">http://metah.ch/blog/2014/05/facebook-sdk-4-0-0-for-php-a-working-sample-to-get-started/</a> wasn't completely correct. </p>
  
  <p>Anyway, when I finally got it to run and enabled "App Secret Proof for Server API calls" under the
  App advanced settings tab as <a href="https://developers.facebook.com/docs/graph-api/securing-requests/" rel="noreferrer">recommended by Facebook</a> I got into a catch 22. </p>
  
  <p>This is it: </p>
  
  <p>1) To make an FB API call from my server, e.g. <code>$request = new FacebookRequest($session, 'GET', '/me');</code> I must now provide an appsecret_proof argument.</p>
  
  <p>2) To create an appsecret_proof I need an access_token i.e. <code>$appsecret_proof= hash_hmac('sha256', $access_token, $app_secret);</code>.</p>
  
  <p>3) To get an access_token with only $_GET['code'] at this point, I must do code exchange via 
  <code>GET https://graph.facebook.com/oauth/access_token?
      client_id={app-id}
     &amp;redirect_uri={redirect-uri}
     &amp;client_secret={app-secret}
     &amp;code={code-parameter}</code>.</p>
  
  <p>4) To call FB for code exchange I get the error <code>{"error":{"message":"This authorization code has been used.","type":"OAuthException","code":100}}</code>.</p>
  
  <p>Two questions arise therefore:</p>
  
  <p>1) How else can I get an access_token except via code exchange, so that I can use that token to create an appsecret_proof and in turn call FacebookRequest?</p>
  
  <p>2) Where/How do I put that appsecret_proof into FacebookRequest? Is it perhaps this way <code>$request = new FacebookRequest($session, 'GET', '/me', array("appsecret_proof" =&gt; $appsecret_proof));</code>? I cannot seem to find the specific instruction on how to use appsecret_proof with PHP API (it is clear how to do it via http with Graph API).</p>