# Trouble Logging in w/ Facebook

**URL:** <https://forum.bubble.io/t/trouble-logging-in-w-facebook/645>\
**Category:** Need help\
**Created:** [November 22, 2015, 5:14am UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645 "2015-11-22T05:14:27Z")\
**Posts on this page:** 14\
**Page:** 2

<div class="post-metadata">

**Author:** ![AlexDaresTo](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alexdaresto/32/20938_2.png) [@AlexDaresTo](https://forum.bubble.io/u/AlexDaresTo)\
**Post date:** [January 31, 2018, 7:58pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/21 "2018-01-31T19:58:26Z")

</div>

Hi everyone!

I have a similar issue. It’s not the UR **L**. I get the error message for UR **I**. Any help please?

_This redirect failed because the redirect URI is not white-listed in the app’s client OAuth settings. Make sure that the client and web OAuth logins are on and add all your app domains as valid OAuth redirect URIs._

Thank you!  
Alex

---

<div class="post-metadata">

**Author:** ![alimo5dec](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@alimo5dec](https://forum.bubble.io/u/alimo5dec)\
**Post date:** [January 31, 2018, 8:23pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/22 "2018-01-31T20:23:40Z")

</div>

A screen shot would be better so we could see what you did wrong

---

<div class="post-metadata">

**Author:** ![AlexDaresTo](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alexdaresto/32/20938_2.png) [@AlexDaresTo](https://forum.bubble.io/u/AlexDaresTo)\
**Post date:** [January 31, 2018, 8:54pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/23 "2018-01-31T20:54:21Z")

</div>

I just don’t know where to get the UR **I** from when Facebook asks for it:

 ![com-2018-01-31-15-53-21-467](https://us1.discourse-cdn.com/bubble/original/3X/1/4/14dcb60eaaec3f84d9ed446a52aacd24c89da9bb.png)That’s in the facebook app \> Products \> Facebook Login \> Settings

---

<div class="post-metadata">

**Author:** ![alimo5dec](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@alimo5dec](https://forum.bubble.io/u/alimo5dec)\
**Post date:** [February 1, 2018, 1:37am UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/24 "2018-02-01T01:37:22Z")

</div>

just copy the exact url from the browser and paste it there when you preview the page(index)

---

<div class="post-metadata">

**Author:** ![AlexDaresTo](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alexdaresto/32/20938_2.png) [@AlexDaresTo](https://forum.bubble.io/u/AlexDaresTo)\
**Post date:** [February 1, 2018, 4:41pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/25 "2018-02-01T16:41:11Z")

</div>

**Thank you! That solved it!**  
When I make the app go live, I’ll have to change that address, right?

---

<div class="post-metadata">

**Author:** ![alimo5dec](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@alimo5dec](https://forum.bubble.io/u/alimo5dec)\
**Post date:** [February 2, 2018, 1:18am UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/26 "2018-02-02T01:18:16Z")

</div>

Yes. Same way:grinning:

---

<div class="post-metadata">

**Author:** ![alijones](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alijones/32/31650_2.png) [@alijones](https://forum.bubble.io/u/alijones)\
**Post date:** [November 6, 2018, 10:42pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/27 "2018-11-06T22:42:35Z")

</div>

Everyone THANK YOU. I cant tell you how many times I’ve read and reread the manual and reference regarding api and the amount of youtube videos I’ve watched trying to figure all of this out. Yet I still suck and can’t get it to work.  
SO  
I _was_ having the same error message that @AlexDaresTo was having:  
 ![41%20PM](https://us1.discourse-cdn.com/bubble/original/3X/a/3/a34844e0faa8c4768c50ac39858e5e206e10e120.png)  
I made sure to apply all of the suggested settings, but still I couldn’t get mine to work. Thus, I went to the plug-in section on bubble and saw that I had checked off the box stating:  
“Use a generic redirect URL ([http://myappsname.bubble.io/api/1.1/oauth\_redirect](http://myappsname.bubble.io/api/1.1/oauth_redirect))”: in my initial attempt of just trying different settings to see what would or wouldn’t be the issue.

 ![bubbleinterfaceredirecturlsamplecheckbox](https://us1.discourse-cdn.com/bubble/original/3X/5/2/527c8e284c5676d73514d76708e722f692715d72.png)  
Once I unchecked it, I got a new error:  
 ![45%20PM](https://us1.discourse-cdn.com/bubble/original/3X/6/1/61d34d89937701638272482a5f8bbf76042fd68f.png)  
Lastly I noticed that on mine (and seemingly not on the others’ from their examples) that facebook seems to autochange my url after pressing enter, removing the words “version-test” on some areas but not in others… is that normal?  
 ![autoappdomainchange](https://us1.discourse-cdn.com/bubble/original/3X/f/8/f82d4f7e931ec5f01408bb8e61dc56e797f36233.png)  
Are you all using the exact same fb plugin? Does it matter/is one easier to use than the other? I was reading in the manual about how bubble plugins are for different purposes than the custom made ones, but it went over my head.  
 ![facebookpluginoptions](https://us1.discourse-cdn.com/bubble/original/3X/3/4/342cf4c3a8d21caf86c7dbf1a4d83da053621eb8.png)  
If anyone wants to chat offline: my email is [alijones@cyphtr.com](mailto:alijones@cyphtr.com)  
Thanks in advance if anyone responds! also these are my settings currently if that helps:  
 ![clientauthosettings](https://us1.discourse-cdn.com/bubble/original/3X/e/9/e947c787c3dfdb169bdfd4cb3354bb6147793832.png)

---

<div class="post-metadata">

**Author:** ![NigelG](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NigelG](https://forum.bubble.io/u/NigelG)\
**Post date:** [November 7, 2018, 7:40am UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/28 "2018-11-07T07:40:47Z")

</div>

> [@georgeciobanu](#):
>
> Make sure the app is enabled in production. Even if it works for you, it won’t work for your users until you do this.

If you are following this advice, it is out of date now. For some reason Facebook have become very sensitive about apps posting on behalf of users, no idea why maybe they had some sort of scandal 🤣

Anyway, the issue is with some of the scopes that the “Facebook Complete” plugin is requesting. They have either been deprecated (you can’t post on a timeline now) or firewalled (posting on a Page).

Scopes are just the things you are asking Facebook to be able to do on behalf of your user. Some fairly innocuous "user\_about\_me " some are BIG “manage\_pages”.

If you request one of the firewalled scopes then you now need to get your app (as in app on Facebook developers console) authorised for it to go in to “live”. If you keep it in development then only the facebook users you tell facebook are your developers will be able to test these actions.

And this is what the message is about.

If all you want to do is “login” with Facebook, and not post on pages etc, then revert to using the Bubble plugin. The “Facebook complete” one is now out of date after the current changes.

---

<div class="post-metadata">

**Author:** ![NigelG](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NigelG](https://forum.bubble.io/u/NigelG)\
**Post date:** [November 7, 2018, 8:18am UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/29 "2018-11-07T08:18:35Z")

</div>

So I jumped into the middle of FB Oauth there, so thought I would back up a little.

Oauth is big and scary, but also quite simple as Bubble users tend to access it in the same way because _most_ Bubble apps are web pages. So once you _get_ it … you get it.

The difficulty with thinking about how it works, from a Bubble perspective, is that you have to split your app in two for the purposes of understanding the “dance”.

If you are a traditional developer, with a split between the front and back end devs (you may not even be in the same country, let alone the same room), it is much easier to think about.

So…Your app has two parts, the web page bits and the workflow bits.

Now for the tricky bit… we don’t trust the web page bits. Bad guys can mess with it. We DO trust the workflow bits. Which is odd for us as they are all the same app as far as we are concerned.

Ok, so this is problem, as the trusted bit isn’t in the browser. And we need the browser to be able to redirect the user to another browser page (to log in) and then back to our page.

So we give the browser some of our information, and let it ask Facebook to sign our user in. It does that by simply asking to go a facebook webpage (ok, it isn’t exactly a “page”, but it looks like one for our purposes).

If you are fast enough, you can grab the redirect URL when you hit the “sign up with Facebook” button. And actually you could dispense with Bubble entirely and just take your user to that URL.

Off we go to the “authorise page”. We tell it who we are (client id, this is totally not secret) and what we want to do (scopes) and where to come back to (redirect\_uri).

Our untrusted web page hasn’t got anything secret to worry about. It is easy to replace your webpage with my webpage. I can use your client id as much as I like. This is all public.

Facebook’s authorisation page checks out the client\_id (yeah, looks legit) and then matches the URL you said to come back to against the list it has. It has to match exactly, and will get fussy about version-test and ?debug\_mode and whether it is http or https.

So if you are having redirect url issues - try to grab the browser URL just after you hit the signup button. That will have the redirect URL in there. Now carefully check that against your app settings in the dev console.

Right, so we check out OK. Facebook asks the user to login, and then it passes control back to the page you specified. And it also passes back a code. Not a secret, it is still in our browser address so I can easily steal as many of your codes as I like. But unique.

We now have to do the secret bits, not trusted to the browser. Our web page passes this code to the back end.

The back end now has a “machine to machine” chat with facebook’s “token” service.

“Hey Facebook, my untrusted front end reckons it asked you for a code, and you gave it _this_ Oh by the way here are my secret passcodes to ensure you know I am who I say I am. Just between you and I, is this legit ?”.

“Yes, that all checks out. Here is really secret token but please keep it really safe and don’t tell your front end”.

And then…

“Hey Facebook’s User details service, I have this super secret token, can you tell me everything about this user please”.

“Sure, that still checks out, here you go”.

In fact Bubble doesn’t even really trust us all that much, so we never get to see that super secret token in most normal situations. It hides it from us.

---

<div class="post-metadata">

**Author:** ![alijones](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alijones/32/31650_2.png) [@alijones](https://forum.bubble.io/u/alijones)\
**Post date:** [November 21, 2018, 3:36am UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/30 "2018-11-21T03:36:50Z")

</div>

ok I uninstalled facebook complete and installed the facebook plugin.  
Now,  
For the snatch and grab method…  
dumb question:

I see what you mean about it having the uri that I need to pluck out and paste into my uri settings. For example I’ll paste below my url that I managed to snatch. Ill replace what might be sensitive numbers with the number 8 and what Im anticipating should be the important part that I need to extract will be bolded and italicized. Also for reference Ill have my original url posted right above it.

Also I originally thought that it ended at the “oauth\_redirect” bit (which is where I have my italicization ending, however I noticed that the bits about “version test” are nowhere to be found and that the “debug\_mode” is further down… So then I thought I’d play around with it since I have the option of adding in several uri’s on facebook’s settings (yes, I did remember to hit save, eventually), but alas, no combination seems to work.

original: [https://myappsname.bubbleapps.io/version-test?debug\_mode=true](https://myappsname.bubbleapps.io/version-test?debug_mode=true)

plucked version: https//myappsname.bubbleapps.io/debug\_mode=true

[https://www.facebook.com/dialog/oauth?client\_id=888888888888888&redirect\_uri=\*\*](https://www.facebook.com/dialog/oauth?client_id=888888888888888&redirect_uri=**)_https%3A%2F%[2Fmyappsname.bubbleapps.io](http://2Fmyappsname.bubbleapps.io)%2Fapi%2F1.1%2F_\*\*oauth\_redirect&response\_type=code&state=%257B%2522debug\_mode%2522%253A%2522true%2522%252C%2522oauth\_provider%2522%253A%2522facebook%2522%252C%2522resume\_key%2522%253A%88888888888888888x247%2522%252C%2522used\_redirect\_url%2522%253A%2522https%253A%252F%[252Fmyappsname.bubbleapps.io](http://252Fmyappsname.bubbleapps.io)%252Fversion-test%253Fdebug\_mode%253Dtrue%2522%252C%2522redirect\_unique\_id%2522%253A%88888888888888888x8888888888888888%2522%257D&scope=email

meh?

---

<div class="post-metadata">

**Author:** ![mebeingken](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/mebeingken/32/20139_2.png) [@mebeingken](https://forum.bubble.io/u/mebeingken)\
**Post date:** [November 21, 2018, 3:29pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/31 "2018-11-21T15:29:22Z")

</div>

Hey Ali,

Here are the settings for a FB login using Bubble’s Facebook plugin:

**Facebook App**

 ![21%20AM](https://us1.discourse-cdn.com/bubble/original/3X/7/f/7f682f9b246d04847410275223a3247e5c5a5261.png)  
 ![20%20AM](https://us1.discourse-cdn.com/bubble/original/3X/7/9/790f63bd59a13223027304101d97ddf46578e432.png)  
 ![34%20AM](https://us1.discourse-cdn.com/bubble/original/3X/f/c/fc824e64129602c058bedbe0f0771b566ea4f8a1.png)

The value for Valid OAuth Redirect URIs points to the Bubble page where you are triggering the social login action noted below. What you see in my sample is three URI’s: One for version-test with debug on, one for version-test with debug off, and a third one for the live site with debug off. All of them, point to fb-basic, which is simply the name of the Bubble page I setup – use whatever you want, just make sure they match.

**Bubble**  
Install the plugin  
Set the app id and secret on the plugin parameters page using the values from the fb app  
Use the social login action to connect a user

 ![20%20AM](https://us1.discourse-cdn.com/bubble/original/3X/7/8/7879ce77b0cb79525d1f1abf063f35a97e5d2bfe.png)

That should get you going!

---

<div class="post-metadata">

**Author:** ![NigelG](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NigelG](https://forum.bubble.io/u/NigelG)\
**Post date:** [November 21, 2018, 3:37pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/32 "2018-11-21T15:37:30Z")

</div>

> [@mebeingken](#):
>
> All of them, point to fb-basic, which is simply the name of the Bubble page I setup – use whatever you want, just make sure they match.

I would be tempted to turn the “use the generic redirect” OFF.

Your app is wanting to redirect to …

[https://myappsname.bubbleapps.io/api/1.1/\*\*oauth\_redirect](https://myappsname.bubbleapps.io/api/1.1/**oauth_redirect)

Do as Ken says, and add the 3x URLs as above, based on the page your button is on.

---

<div class="post-metadata">

**Author:** ![mebeingken](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/mebeingken/32/20139_2.png) [@mebeingken](https://forum.bubble.io/u/mebeingken)\
**Post date:** [November 21, 2018, 3:44pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/33 "2018-11-21T15:44:54Z")

</div>

Ha! I didn’t even see that the plugin supported the generic redirect like the api connector.

@NigelG I just switched it to generic and it works fine. Have you had bad luck with that?

---

<div class="post-metadata">

**Author:** ![alijones](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alijones/32/31650_2.png) [@alijones](https://forum.bubble.io/u/alijones)\
**Post date:** [November 21, 2018, 4:55pm UTC](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645/34 "2018-11-21T16:55:40Z")

</div>

IT WORKSSSS

Ok so I tried both using and not using the generic oauth redirect. Still didnt do anything, but I noticed that you suggested to turn off “Embedded Browser OAuth Login” in your settings (which someone else had directed otherwise- I think it was this thread actually). But I turned mine off, and tested the generic “[https://myapps](https://myapps) [name.bubbleapps.io/api/1.1/oauth\_redirect](http://name.bubbleapps.io/api/1.1/oauth_redirect)” in the Redirect URI Validator.

 ![44%20AM](https://us1.discourse-cdn.com/bubble/original/3X/0/7/077c14a335ee2ddb71104e06f10ca2eb2c6c585e.png)  
It said I was good to go. So I re-entered it into the settings above, hit save, and voila!  
I could kiss you all!😍

[Previous page](https://forum.bubble.io/t/trouble-logging-in-w-facebook/645.md?page=1)
