title: Refresh expired access tokens using serverside flow automatically
body: <p>Well there seems to be quite a bit of confusion on this topic and I am struggling to get a clear answer, so here is my question...</p>
  
  <p>I am using the serverside flow to obtain access tokens for my web app, I previously used offline_access which is now being depreciated so I need a way to refresh the token in the following situations:</p>
  
  <p>1) User changes FB password
  2) Token expires naturally</p>
  
  <p>My app posts results to users FB walls so the refresh needs to be done automatically by our server (no cookies or OAuth dialogs)</p>
  
  <p>I thought I could try to use the new endpoint described here </p>
  
  <p><a href="http://developers.facebook.com/roadmap/offline-access-removal/" rel="nofollow">http://developers.facebook.com/roadmap/offline-access-removal/</a></p>
  
  <p>, with the following piece of code (Java):</p>
  
  <pre><code>public static String refreshFBAccessToken(String existingAccessToken)
          throws Exception{
      //Currently not working
      String refreshUrl = "https://graph.facebook.com/oauth/access_token?
          client_id="+FacebookApp.appId+"
          &amp;client_secret="+FacebookApp.appSecret+"
          &amp;grant_type=fb_exchange_token
          &amp;fb_exchange_token="+existingAccessToken;
      URL url = new URL(refreshUrl);
      URI uri = new URI(url.getProtocol(), url.getHost(), url.getPath(),
              url.getQuery(), null);
      String result = readURL(uri.toURL());
      String[] resultSplited = result.split("&amp;");
      return resultSplited[0].split("=")[1];
  }
  </code></pre>
  
  <p>But this doesnt seem to work (I get a response 400), and when I re-read the documentation it seems this endpoint is used for tokens obtained using the client-side flow only...</p>
  
  <p>So what about the serverside flow....?</p>
  
  <p>Can someone tell me if the approach above is correct or there is another way?</p>
  
  <p>Many thanks</p>