title: How to get access_token in signed_request in canvas app, if an already authorized user needs more permissions now?
body: <p>Let's assume the following situation for a canvas app:</p>
  
  <p>i) day 1:
   - Facebook app is created which needs
     <code>read_stream,publish_stream,offline_access</code> permissions.   When a
     user comes to app for first time, <code>authorize</code> call redirects the user
     to a permission ALLOW / DENY screen , and when the user allows it
     redirects the user back to canvas url.</p>
  
  <p>The canvas url has access_token in a signed request in its request
     parameters which can then be used to run the app.</p>
  
  <p>No permission dialog is needed for same user coming to the app next
     time, as signed_request contains acess_token if the user had
     authorized the  app in past.</p>
  
  <p>The code looks like:</p>
  
  <pre><code>if(access_token received from signed request)
  // do something with user information
  else
  // redirect user for authorization flow
  </code></pre>
  
  <p>ii) day 2: - Now, let's say I want to add one more permission to my list, <code>user_birthday
  </code>read_stream,publish_stream,offline_access,user_birthday`
  Now the following logic will have problems</p>
  
  <pre><code>  if(access_token received from signed request)
      // do something with user information  &lt;-- the access_token does not have new permission
      else
      // redirect user for authorization flow
  </code></pre>
  
  <p>How can this additional permission addition be tackled efficiently, as API calls
  affect the performance of the app?
  I would not want to use something like :</p>
  
  <pre><code>https://graph.facebook.com/me/permissions?access_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  </code></pre>
  
  <p>Every time the application loads to check the permissions related to the token.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>Sharing a good method :
  Store the permission set along with the access_token with which it was received.
  eg. If current permissions are "basic_details-birthday-publish" (lets call it 1),
  store the access_token and permission set as </p>
  
  <pre><code>user  | access_token  | perm_set
  Dhruv      sdfsdfsdf       1
  </code></pre>
  
  <p>Now,in your settings, whenever you need to ask for a new permission, create a new permission set "basic_details-birthday-publish-checkins" (lets call it 2),</p>
  
  <p>then you need to show the permissions dialog only for users who have access token with perm_set = 1 and not for users who already have perm_set = 2, this will get rid of the need to check access_token of each user with "/me/permissions" api.</p>