Facebook Login Integration for Mobile Apps
When integrating Facebook Login into a mobile app, developers often run into non-obvious problems: incorrect URL scheme configuration, missing App Tracking Transparency (ATT) handling, server-side token verification. It seems enough to plug in the SDK and call login, but in practice 40% of incidents arise from incorrect iOS or Android configuration. We have completed over 50 integrations and identified three key mistakes: ignoring server-side token verification, requesting unnecessary permissions, and failing to test the scenario without the Facebook app installed. Our engineers have optimized the process — development time savings reach 40% compared to self-implementation. Request a consultation for your app integration.
Technical Integration: iOS and Android
Meta SDK: For iOS we use pod 'FacebookLogin' (CocoaPods) or Swift Package Manager. For Android — implementation 'com.facebook.android:facebook-login:latest'. The SDK adds ~4–8 MB to binary size. If binary size is critical, there is an alternative — implement OAuth 2.0 PKCE flow through the browser without the Meta SDK. PKCE implementation reduces binary size by 35% compared to the full SDK, but loses native user experience: no "Log in with Facebook" button with branded style, no automatic switch to the Facebook app. Full Meta SDK allows completing integration 2-3 times faster than manually writing OAuth PKCE.
| Characteristic | Full SDK | OAuth PKCE without SDK |
|---|---|---|
| Binary size | +4–8 MB | +0 MB (only URL scheme) |
| Native UX | Yes | No (browser flow) |
| Implementation time | 1–2 days | 3–4 days (manual handling) |
On iOS you need:
- Add
FacebookAppID,FacebookDisplayNameand URL Schemefb{app_id}toInfo.plist. - In
AppDelegateorSceneDelegate, overrideapplication(_:open:options:)and forward control toApplicationDelegate.shared. - For iOS 14+ — request App Tracking Transparency permission via
ATTrackingManager.requestTrackingAuthorization(). Without this, Facebook will only receive limited data.
On Android:
- Add
<meta-data android:name="com.facebook.sdk.ApplicationId" android:value="@string/facebook_app_id"/>toAndroidManifest.xml. - For Android 11+ you must specify
<queries>with the Facebook package, otherwise Intent to the Facebook app will fail. - Use
LoginManager.getInstance().logInWithReadPermissions(...)to launch the login flow.
Facebook Login Integration Process
- Register app in Facebook Developers Console and obtain App ID, App Secret.
- Integrate SDK via CocoaPods, Swift Package Manager (iOS) or Gradle (Android).
- Implement login flow with permission requests (public_profile, email).
- Server-side token verification via Graph API debug_token (mandatory).
- Test on real devices with and without the Facebook app installed.
- Publish to App Store and Google Play with correct settings.
What Permissions to Request?
Minimal permission set: ["public_profile", "email"]. public_profile returns id, name, picture. email may be null — Facebook does not verify the user's email, and the user can hide it in settings. This must be handled on client and server: if email is not returned, request it additionally or offer an alternative authentication method. Request only the permissions you actually need to avoid scaring off users — login conversion drops by 20% when requesting unnecessary permissions.
| Type of permissions | Data | Level |
|---|---|---|
| public_profile | id, name, picture | Low (no review) |
| email (may be null) | Low | |
| user_friends | friends list | Medium (requires review) |
| publish_actions | publish on behalf of user | High (disabled since 2018) |
Graph API and Server-Side Verification
After obtaining accessToken, the client sends it to the backend. The backend makes a request to Graph API:
GET graph.facebook.com/me?fields=id,name,email,picture.type(large)&access_token=TOKEN id is an App-Scoped ID: the same user sees different IDs in different apps. For verification we use:
GET graph.facebook.com/debug_token?input_token=TOKEN&access_token=APP_TOKEN Where APP_TOKEN = app_id|app_secret. The response must contain is_valid: true, app_id matching yours, and expires_at not expired. Meta recommends server-side validation (Graph API documentation).
Why Server-Side Verification Is Mandatory?
Without it, an attacker can forge a token or use a token from another app. Server-side check is the only reliable way to ensure the token was issued for your Facebook App and has not expired. We always include this step in our integrations.
Checklist of Common Problems
- On iOS, Facebook button does not open dialog — check
AppDelegateconfiguration and URL schemefb{app_id}. - On Android, Facebook app is not detected — for Android 11+ you must add
<queries>to the manifest. - email comes null — user hid email in settings, handle as normal case.
- Token fails verification on server — check
APP_TOKENand expiration; ensure token is from yourapp_id. - Login does not work without Facebook app — SDK automatically falls back to browser, check deep link handling.
How to Test Facebook Login?
Use TestFlight (iOS) and Firebase App Distribution (Android). Create test users in Facebook Developers Console. Test both scenarios: with Facebook app installed and via browser. Ensure deep links (Universal Links / App Links) return the user to the app after login. Starting from iOS 14.5, Facebook requires ATT request for access to IDFA. If the user denies, Facebook SDK automatically uses alternative tracking methods, but the data volume is reduced. We recommend preparing an explanation of why your app needs tracking beforehand.
What Our Work Includes
- Connecting and configuring Facebook SDK on iOS (Swift) and Android (Kotlin/Java).
- Implementing login flow with permission handling.
- Server-side token verification via Graph API debug_token.
- Handling cases: missing email, denied permissions, expired token.
- Testing on devices with/without Facebook app.
- Documentation on integration scheme and instructions for publishing to App Store and Google Play.
Timeline: from 5 to 8 business days for both platforms. We have completed over 50 Facebook Login integrations. Order implementation — we will connect everything in 5–8 days. Contact us for a project estimate.