title: Facebook access token: server-side vs client-side flows
body: <p><a href="http://developers.facebook.com/docs/authentication/" rel="noreferrer">Facebook docs</a>:</p>
  
  <blockquote>
    <p>Facebook Platform supports two different OAuth 2.0 flows for user login: <strong>server-side</strong> (known as the authentication code flow in the specification) and <strong>client-side</strong> (known as the implicit flow). The server-side flow is used whenever you need to call the Graph API from your web server. The client-side flow is used when you need to make calls to the Graph API from a client, such as JavaScript running in a Web browser or from a native mobile or desktop app.</p>
  </blockquote>
  
  <p>What is the difference between <strong>access tokens</strong> taken by these flows?
  It seems like they length differ.</p>
  
  <p>Can we use <strong>server-side flow token</strong> on a client? And otherwise, can we use <strong>client-side flow token</strong> on a server?</p>