Rails: Could not authenticate you from Facebook because "Invalid credentials"

Question

I integrated omniauth-facebook using https://github.com/plataformatec/devise/wiki/OmniAuth%3a-Overview. But I am getting error of :

Could not authenticate you from Facebook because "Invalid credentials".

And in logs, getting this:

Authentication failure! invalid_credentials: OAuth2::Error, : {"error":{"message":"This authorization code has been used.","type":"OAuthException","code":100}}

I have devise installed. When i click on facebook sign in link, it comes back to devise sign "www.mealnut.com/user/sign_in#=" and gives above error. I checked the solution for "Invalid credentials" on https://github.com/plataformatec/devise/wiki/OmniAuth%3a-Overview and as mentioned there, my app is header set for App Type = Web. Not getting why it is not working.

Also my app is pending review from facebook. But i don't think it is related to this error. Following are the things i did for omniauth-facebook:

Gemfile contains:

gem "omniauth", "~> 1.1.4"
gem 'omniauth-facebook', '1.4.1'

In user model, added:

devise :omniauthable, :omniauth_providers => [:facebook]
attr_accessible :provider, :uid

  def self.find_for_facebook_oauth(auth, signed_in_resource=nil)
    user = User.where(:provider => auth.provider, :uid => auth.uid).first
    unless user
    user = User.create(name:auth.extra.raw_info.name,
                       provider:auth.provider,
                       uid:auth.uid,
                       email:auth.info.email,
                       password:Devise.friendly_token[0,20]
                      )
  end
user
end

devise.rb

require "omniauth-facebook"
config.omniauth :facebook, "APP_ID", "APP_SECRET", :scope => "offline_access, email" 

omniauth.rb:

OmniAuth.config.logger = Rails.logger
Rails.application.config.middleware.use OmniAuth::Builder do
 provider :facebook, ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET'], {:provider_ignores_state => true}
end

route.rb:

devise_for :user, :controllers => { :omniauth_callbacks => "omniauth_callbacks" }

Omniauth controller:

class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def facebook
    @user = User.find_for_facebook_oauth(request.env["omniauth.auth"], current_user)

    if @user.persisted?
      sign_in_and_redirect @user, :event => :authentication #this will throw if @user is not activated
      set_flash_message(:notice, :success, :kind => "Facebook") if is_navigational_format?
    else
      session["devise.facebook_data"] = request.env["omniauth.auth"]
      redirect_to new_user_registration_url
    end
  end
end

Can anybody help in this?

Answer 1

Thought I'd chip in here since this came up for me when trying to search for a solution for Could not authenticate you from Facebook because “Invalid credentials”

The problem is with Facebook API version >=2.3 you need to set {token_params: {parse: :json}} to your provider config.

devise.rb

config.omniauth :facebook,
    APP_ID,
    APP_SECRET,
    token_params: { parse: :json } # <----- this line is NB

Answer found on this issue for omniauth-oauth2

UPDATE Aug 2018: The "invalid credentials" issue reoccurred, I had to remove the token_params setting for it to work again - so this may not be an issue anymore

Answer 2

Got it working!

My routes.rb and user.rb were wrong. And changed omniauth.rb too! Here are the previous and after files:

My routes.rb was:

devise_for :user, controllers: { registration: "registration" }
devise_for :user, controllers: { omniauth_callbacks: "omniauth_callbacks" }

So it was calling devise twice. I changed it to:

devise_for :user, controller: { registration: "registration", omniauth_callbacks: "omniauth_callbacks" }

Changed my omniauth.rb from this:

OmniAuth.config.logger = Rails.logger

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :facebook, ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET'], provider_ignores_state: true
end

to this:

OmniAuth.config.logger = Rails.logger

Also, i defined method def self.find_for_facebook_oauth(auth, signed_in_resource=nil) outside user.rb model (major mistake).

So got it working perfectly now :-)

Hope this helps someone.

Answer 3

Got it working too :) We don't need to add this code in omniauth.rb

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :facebook, ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET']
end

if we already declare it in devise.rb

require "omniauth-facebook"
config.omniauth :facebook, "APP_ID", "APP_SECRET"

Answer 4

It helped me to solve a similar problem:

Note: v2.0.1 has an issue with callback url error. You need to add a callback url on config.

config.omniauth :facebook, "APP_ID", "APP_SECRET",
                callback_url: "CALLBACK_URL"

https://github.com/plataformatec/devise/wiki/OmniAuth%3a-Overview

Answer 5

Upgrading gem to 4.0.0 and adding require "omniauth-facebook" to devise.rb fixed this for me.

Answer 6

I stack with this problem and no one advice was help me. Problem was in redirect_uri. Devise omniauth gems generated it without https.

Finally resolved this by two steps:

• Add force_ssl for rails.
• Do not forget to add proxy_set_header X-Forwarded-Proto https; for nginx config, if you are using it.