title: ASP.NET Web API and Identity with Facebook login
body: <p>In the Facebook authentication flow for ASP.NET Identity, the Facebook OAuth dialog appends a code rather than an access token to the <code>redirect_url</code> so that the server can exchange this code for an access token via e.g.: </p>
  
  <pre><code>http://localhost:49164/signin-facebook?code=…&amp;state=…
  </code></pre>
  
  <p>My problem is that my client is a mobile app which uses the Facebook SDK, and that straight away gives me an access token. Facebook says using the SDK <em>always</em> gives you an access token, so can I just give this directly to ASP.NET Web API?</p>
  
  <p>I understand this is not very secure, but is it even possible?</p>