Why does my Facebook Trigger return an 'Application Secret required' error when using a Page Access Token?

Below is an explanation of the situation and some pointers on what might be causing the error:

What’s Happening

You followed the instructions from the Facebook App credentials documentation and were able to receive test webhooks from the Facebook App/Webhook interface. However, you aren’t getting notifications when an actual comment is posted. After switching to a Page Access Token, the error you get when testing in n8n is:

  Facebook Trigger: (#190) Application Secret required for this endpoint

Even after pasting your App Secret into the Facebook Credential in n8n, the error persists.

Why the Error Occurs

The error message (#190) indicates that the endpoint Facebook is calling requires the application secret to be used alongside the access token. In this context:

• App Access Token vs. Page Access Token:
  The Facebook Trigger node (using Facebook App credentials) is designed to work with an App Access Token. Switching to a Page Access Token (and using it in place of the App Access Token) can lead to inconsistencies. Facebook may require that requests made with a Page Access Token also include the proper app secret proof (a hashed version of the access token and your App Secret). Essentially, Facebook expects that either an app access token is used or that the token (if a Page token is being used) is properly supplemented with the corresponding App Secret.

• App Secret Proof:
  When an App Secret is provided, Facebook uses it to validate API calls via the appsecret_proof parameter. The error message suggests that although you entered the App Secret, it is either not being combined appropriately with the token (perhaps due to using the wrong token type) or the endpoint itself requires an app access token and its related configuration.

Is This an n8n Bug?

Based on the documentation, the Facebook Trigger node is designed to work with an App Access Token (optionally including the App Secret for added security). The error you’re seeing typically points to a configuration mismatch rather than an inherent bug in n8n. In other words, it’s more likely that:

• The token type provided (Page vs. App access token) is causing Facebook’s API to fail the request.
• The integration is not receiving the proper appsecret_proof because the token type isn’t the one expected by Facebook for that endpoint.

What to Do Next

1. Revert to an App Access Token:
   Double-check that you are using the App Access Token provided by the Graph API explorer (as described in the documentation for Facebook App credentials). This is the token that the Facebook Trigger node expects for a proper test and production webhook.

2. Confirm Your App Secret is Correctly Configured:
   Ensure that the App Secret you pasted into the n8n credential exactly matches what you see in your Meta app settings. The App Secret is optional but may be required by certain endpoints if the provided token is not sufficient on its own.

3. Check Your Webhook Subscription:
   Verify that your webhook is subscribed to the correct objects and events (in your case, the comment events on posts). The Facebook App documentation for triggering notifications outlines how to verify this configuration.

4. Review Facebook Documentation:
   Further details in Meta’s Graph API documentation can help clarify which token types and parameters are needed for different endpoints. This helps ensure compatibility between your webhook and the token configuration.

In Summary

This error is likely due to a misconfiguration between using a Page Access Token instead of the expected App Access Token and/or the improper handling of the App Secret for signing the request. It doesn’t appear to be a bug in n8n itself; rather, it’s an alignment issue between the Facebook API’s requirements and the tokens/credentials provided.

Try reverting to the App Access Token configuration (with the correct App Secret, if desired) and re-test the setup. This should align with the documentation provided in the Facebook App credentials section of n8n Docs.