title: restfb: Writing a facebook application with java (using the new graph api)
body: <p>I'm trying to write a facebook application using Java tomcat with RestFB.</p>
  
  <p>the restfb documentation shows the following:</p>
  
  <ul>
  <li>Create a Facebook Application</li>
  <li>Request <a href="https://graph.facebook.com/oauth/authorize?client_id=MY_API_KEY&amp;" rel="nofollow">https://graph.facebook.com/oauth/authorize?client_id=MY_API_KEY&amp;</a> redirect_uri=http://www.facebook.com/connect/login_success.html&amp; scope=publish_stream,offline_access,create_event</li>
  <li>Facebook will redirect you to <a href="http://www.facebook.com/connect/login_success.html" rel="nofollow">http://www.facebook.com/connect/login_success.html</a>? code=MY_VERIFICATION_CODE</li>
  <li>Request <a href="https://graph.facebook.com/oauth/access_token?client_id=MY_API_KEY&amp;" rel="nofollow">https://graph.facebook.com/oauth/access_token?client_id=MY_API_KEY&amp;</a> redirect_uri=http://www.facebook.com/connect/login_success.html&amp; client_secret=MY_APP_SECRET&amp;code=MY_VERIFICATION_CODE</li>
  <li>Facebook will respond with access_token=MY_ACCESS_TOKEN</li>
  </ul>
  
  <p>I think that i may be looking at the wrong instructions and this is for a facebook connect or anything else besides an actual facebook application inside apps.facebook.com/app_name.</p>
  
  <p>I would really appreciate any relevant information regarding the issue. I'm simply trying to create a simple facebook application that prints the name of the user.</p>
  
  <p>In general after I fetch the acces token of the user i can do the following:</p>
  
  <pre><code>FacebookClient facebookClient = new DefaultFacebookClient(MY_ACCESS_TOKEN);
  User user = facebookClient.fetchObject("me", User.class);
  out.println("User name: " + user.getName());
  </code></pre>
  
  <p>My problem is how do i properly fetch the access token of the user? in the information i showed at the top of the post, it shows that i need to make 2 requests. the first for the code and the other for the acess token. and the request for the access token actually reveals my app secret key to the user because each time i forward him to a different page the user can easily view the get and set parameters.</p>
  
  <p>so i guess i'm pretty lost here. </p>
  
  <p>please help! :)</p>
  
  <p>thanks</p>
  
  <h1>update after comments</h1>
  
  <p>with these instructions i need two times to redirect the user's page. first to  get the code and then to get the access token. the user can see these two redirections and because of that he can easily see the facebook application key and secret key from the get parameters. how do i make sure that these steps are hidden from the user?  </p>