About this tool
Meta's Graph API offers a second layer of protection for server-side calls called the app secret proof: instead of sending your access token alone, you attach an appsecret_proof parameter — the HMAC-SHA256 of the access token, keyed with your app secret — proving the request comes from someone who holds both. Once you enable Require App Secret in the app dashboard, calls without a valid proof are rejected, which is exactly when debugging gets annoying. This tool computes the proof for you instantly and locally. Paste a user or page access token and your app secret, and the page derives the hexadecimal HMAC-SHA256 digest with the Web Crypto API — no libraries, no network round trips. It also builds a ready-to-use Graph API URL with the access_token and appsecret_proof parameters filled in, plus a curl command you can paste straight into a terminal to test the call. That makes it easy to verify that a token-plus-secret pair still works before wiring the same math into your backend. The computation runs entirely in your browser, so neither the token nor the app secret — the two values an attacker would need together — is ever transmitted to this site or to anyone else.
How to use Meta App Secret Proof
- Paste the user or page access token you want to call the Graph API with.
- Paste your Meta app secret from the app dashboard's Settings → Basic page.
- Copy the computed appsecret_proof hex digest.
- Use the generated Graph API URL or curl command to make a proof-enabled test call.
Frequently asked questions
What exactly is the appsecret_proof?
It is the HMAC-SHA256 of the access token, keyed with your app secret and hex-encoded. Meta verifies it server-side to confirm the caller holds both the token and the secret.
When is the proof required?
Only after you enable Require App Secret in the app dashboard's advanced settings. Server-side apps should turn it on: it stops a leaked token from being usable on its own.
Is it safe to paste my token and secret here?
Yes — the HMAC is computed locally with crypto.subtle and nothing is transmitted. Together the token and secret are highly sensitive, which is precisely why the math happens on your machine.
Does the proof change over time?
No — it is a pure function of the token and secret, with no timestamp. You compute a new proof only when the access token changes, because tokens expire or are refreshed.