There is another way to do this with oAuth v2, and this is described in facebook docs, but divided into several pages, so they are not easy to understand.
First, you need to activate the "OAuth 2.0 for Canvas" flag in the "advanced options" of your application.
And now, here is a PHP example explaining how to handle it:
function parse_signed_request($signed_request, $secret) { list($encoded_sig, $payload) = explode('.', $signed_request, 2); // decode the data $sig = base64_url_decode($encoded_sig); $data = json_decode(base64_url_decode($payload), true); if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') { error_log('Unknown algorithm. Expected HMAC-SHA256'); return null; } // check sig $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true); if ($sig !== $expected_sig) { error_log('Bad Signed JSON signature!'); return null; } return $data; } function base64_url_decode($input) { return base64_decode(strtr($input, '-_', '+/')); } $data = parse_signed_request($_REQUEST["signed_request"], <your facebook app api secret>); if (empty($data["user_id"]) && !isset($_REQUEST['redir'])) { // The user isn't authenticated $auth_url = "http://www.facebook.com/dialog/oauth?client_id=" . <your facebook app id> . "&redirect_uri=" . urlencode('http://apps.facebook.com/<yourapp>/?redir=1'); echo("<script> top.location.href='" . $auth_url . "'</script>"); die; } // Here the user is authenticated echo ("Welcome User: " . $data["user_id"]); // And now you have the Graph API auth token in $data["oauth_token"], // so you can use any graph api method