title: How do you renew an expired Facebook access token?
body: <p>I am working from <a href="https://developers.facebook.com/docs/authentication/">this reference</a>, and trying to implement the OAuth protocol to allow users to log into my site via Facebook. However, Facebook's documentation is pretty terrible and it unclear in a few key parts.</p>
  
  <p>It says that authorization takes three steps:</p>
  
  <ol>
  <li><p>User authentication (redirect the user to <code>https://facebook.com/dialog/oauth?client_id=...&amp;redirect_uri=...</code>, and expect the <code>redirect_uri</code> page to be called back with a <code>code</code>). Works great!</p></li>
  <li><p>App authorization (handled by Facebook, etc). Works great!</p></li>
  <li><p>App authentication (On the callback page, grab the <code>code</code> you get and call <code>https://graph.facebook.com/oauth/access_token?client_id=...&amp;redirect_uri=...&amp;client_secret=...&amp;code=...</code>. The body of the response will include an <code>access_token</code> we need to do stuff)</p></li>
  </ol>
  
  <p>I understand that with the <code>access_token</code>, I can call the APIs and such. But, what happens when it expires? I could get a new one, but by this point it will be many HTTP requests later, and I no longer have the <code>code</code> I used to get it in the first place. Do I have to store the <code>code</code> along side the <code>access_token</code>? Or, do I have to tell the user to log in again so I get a new <code>code</code> to get a new <code>access_token</code>?</p>
  
  <p>Or, am I missing a key part here? I don't need an <code>offline_access</code> token, as I will only be polling data in response to user actions .</p>