Andrew Dorokhov
The app and User IDs are both encoded in the token itself (among other things). Facebook uses those IDs to track which data the User has permitted the app to access.
For example, inspecting a token after the User granted permission might reveal something like:
| Field | Example |
|---|---|
| App | 374809346238210 : iPhoneHelp.expert |
| User | 1040821862717255 : David Payette |
| Valid | true |
| Expires | 1561828809 (Sat Jun 29 2019 20:20:09 GMT+0300) |
| Scopes | public_profile |
See also the official open_in_new access token documentation .