Facebook Login

Facebook Login uses the Socialite facebook driver for web OAuth and access-token verification for native clients.

Meta Developer

1. Create a Facebook app (type: Consumer or appropriate for login).
2. Add Facebook Login product.
3. Set Valid OAuth Redirect URIs to {APP_URL}/auth/facebook/callback.
4. Add privacy policy URL and app domains.
5. Configure a Data Deletion Callback URL: {APP_URL}/facebook/data-deletion (POST).

Request scopes: email, public_profile.

API environment

FACEBOOK_CLIENT_ID=...
FACEBOOK_CLIENT_SECRET=...
FACEBOOK_REDIRECT_URI=https://api.example.com/auth/facebook/callback

Web app

When authMethods.facebook is true:

• Login (intent=login) never creates accounts. If Facebook returns a verified email that already belongs to a Garrison account, that account is signed in and Facebook is linked. Otherwise unknown Facebook users see “not connected”.
• Register (intent=register) → /register/complete. If Facebook returns no verified email, the finish step collects and confirms a Garrison email.

Profile → Connected accounts can link Facebook when emails differ.

Mobile

Android and iOS use the Facebook SDK; the app sends an access token to loginWithFacebook. The API verifies via Graph debug_token and loads profile data. Unknown Facebook identities do not create accounts on mobile — users must register on the web app first.

Android

Set in mobile/gradle.properties or as Gradle properties:

FACEBOOK_APP_ID=...
FACEBOOK_CLIENT_TOKEN=...

iOS

Set in mobile/iosApp/Configuration/Config.xcconfig:

FACEBOOK_APP_ID=...
FACEBOOK_CLIENT_TOKEN=...

The Facebook Login Swift package is referenced from mobile/iosApp. Use classic login (not Limited Login) so the API can verify the Graph access token.

Data deletion

Meta requires a callback when users remove the app. The API endpoint accepts signed deletion requests and records the request (see FacebookDataDeletionController).

Smoke test

1. Register with Facebook (verified email) → /register/complete → account created.
2. Register without email → prompted for email on finish page.
3. Login unknown Facebook (no matching email) → not linked; Register or profile link after sign-in.
4. Trigger data deletion callback from Meta app dashboard (test user).