Restful API - Check if Facebook access token is valid and authorized to use APP

I am building a restful API (PHP) to serve iOS and Android applications and I would like to implement facebook login on both apps.

The flaw is like the following :

• Clients ( ios or Android ) login with facebook and send an access_token to the restful api
• verify if the access_token is authorized to use the application
• If token is valid, get user data from graph.
• Merge accounts and generate token for different queries.

For security purpose to avoid getting random tokens thatthey don't belong to my APP, I would like to make a test call to check if a token is authorized and valid or not ?

I know many similar questions might be already answered but none of them really give me the right answer and I don't really have experience with facebook graph.

I found this solution :

https://graph.facebook.com/oauth/access_token?client_id=APP_ID&client_secret=SECRET_APP_ID&grant_type=fb_exchange_token&fb_exchange_token=ACCESS_TOKEN

This works somehow .. it whether give me an error, or an access token (string format not JSON) and I am not sure if this is the best way to test or not.

Note: I am still in early stage of development, if you have any suggestion on my flow please let me know, I might be doing things the wrong way ?

“Random” tokens would not work anyway. (Tokens issued by Facebook are encrypted, so the API can tell whether a token is genuine, or just "random". At most you'd need to worry about what a user possible could using a token for a different app, or one they themselves granted more permissions than you asked them for.)

Just request the user details using the access token you got - if it is not valid because someone tried to “fake” it, then the API response will tell you so.

The docs have a chapter about securing API requests, go check that out as well: https://developers.facebook.com/docs/graph-api/securing-requests