What causes "Delete requires an access token" in arsduo/koala?

Create the API with a valid access token: Koala::Facebook::API.new(token)

arsduo/koala · error · Koala::Facebook::AuthenticationError

Delete requires an access token

Error message

Delete requires an access token

What it means

delete_object raises Koala::Facebook::AuthenticationError ('Delete requires an access token') when the API instance has no access_token (lib/koala/api/graph_api_methods.rb:109). Deleting a Graph object always requires an authenticated context, so Koala blocks the call client-side — the error is built with nil http_status, meaning no request was sent to Facebook. delete, collection helpers such as delete_all, and every other caller of delete_object pass through this same guard.

Source

Thrown at lib/koala/api/graph_api_methods.rb:109

      # @see #put_connections
      #
      # @note put_object is (for historical reasons) the same as put_connections.
      #       Please use put_connections; in a future version of Koala (2.0?),
      #       put_object will issue a POST directly to an individual object, not to a connection.
      def put_object(parent_object, connection_name, args = {}, options = {}, &block)
        put_connections(parent_object, connection_name, args, options, &block)
      end

      # Delete an object from the Graph if you have appropriate permissions.
      #
      # @param id (see #get_object)
      # @param options (see #get_object)
      # @param block (see Koala::Facebook::API#api)
      #
      # @return true if successful, false (or an APIError) if not
      def delete_object(id, options = {}, &block)
        # Deletes the object with the given ID from the graph.
        raise AuthenticationError.new(nil, nil, "Delete requires an access token") unless access_token
        graph_call(id, {}, "delete", options, &block)
      end

      # Fetch information about a given connection (e.g. type of activity -- feed, events, photos, etc.)
      # for a specific user.
      # See {http://developers.facebook.com/docs/api Facebook's documentation} for a complete list of connections.
      #
      # @note to access connections like /user_id/CONNECTION/other_user_id,
      #       simply pass "CONNECTION/other_user_id" as the connection_name
      #
      # @param id (see #get_object)
      # @param connection_name what
      # @param args any additional arguments
      # @param options (see #get_object)
      # @param block (see Koala::Facebook::API#api)
      #
      # @return [Koala::Facebook::API::GraphCollection] an array of object hashes (in most cases)
      def get_connection(id, connection_name, args = {}, options = {}, &block)

View on GitHub (pinned to 47d052063e)

Solutions

Create the API with a valid access token: Koala::Facebook::API.new(token)
Verify the token value at the call site (session, ENV, credentials) — nil here is exactly what triggers the guard
If the token may be stale, validate it first with Koala::Facebook::OAuth.new(app_id, app_secret).debug_token(token)
Rescue Koala::Facebook::AuthenticationError and restart OAuth instead of letting the delete crash

Example fix

# before
api = Koala::Facebook::API.new
api.delete_object('1015550') # => AuthenticationError: Delete requires an access token

# after
api = Koala::Facebook::API.new(ENV.fetch('FB_TOKEN'))
api.delete_object('1015550') # => true

Defensive patterns

Strategy: validation

Validate before calling

raise ArgumentError, 'delete_object requires an access token' unless api.access_token
api.delete_object(id)

Try / catch

begin
  api.delete_object(id)
rescue Koala::Facebook::AuthenticationError => e
  # nil http_status => client-side guard: token missing at call time
  clear_session_token_and_relogin!
end

Prevention

Check api.access_token before destructive calls — nil should trigger re-auth, not a mid-request raise
Use ENV.fetch / Rails credentials with fail-fast so tokens are never silently nil
Wrap delete flows in AuthenticationError handling that clears the stale token and re-runs OAuth
Stub the access token in specs so delete_object reaches the mocked HTTP layer

When it happens

Trigger: api.delete_object('123_456'), api.delete('123_456'), or a graph collection's delete_all where the owning API was created without a token — e.g. Koala::Facebook::API.new followed by a delete, or a token variable that evaluated to nil at construction time.

Common situations: Cleanup/rollback jobs built on a tokenless API; user sessions whose token was cleared on logout but the delete request still arrives; specs constructing Koala::Facebook::API.new without stubbing a token; env var name typos that pass nil silently.

Related errors

AI-assisted analysis of arsduo/koala@47d052063e (2026-08-23). Data as JSON: /api/errors/ac9b4fc83f90b747. Report an issue: GitHub.