arsduo/koala · error · Koala::Facebook::AuthenticationError

Unliking requires an access token

Error message

Unliking requires an access token

What it means

delete_like raises Koala::Facebook::AuthenticationError ('Unliking requires an access token') when access_token is nil (lib/koala/api/graph_api_methods.rb:338). Unliking issues DELETE on '<id>/likes' as the logged-in user, so it can never run unauthenticated; Koala enforces this before any HTTP request (nil http_status on the error). put_like fails symmetrically through the put_connections guard with 'Write operations require an access token'.

Source

Thrown at lib/koala/api/graph_api_methods.rb:338

      # @param block (see Koala::Facebook::API#api)
      #
      # @return (see #put_connections)
      def put_like(id, options = {}, &block)
        # Likes the given post.
        put_connections(id, "likes", {}, options, &block)
      end

      # Unlike a given object.
      # Convenience method equivalent to delete_connection(id, "likes").
      #
      # @param id (see #get_object)
      # @param options (see #get_object)
      # @param block (see Koala::Facebook::API#api)
      #
      # @return (see #delete_object)
      def delete_like(id, options = {}, &block)
        # Unlikes a given object for the logged-in user
        raise AuthenticationError.new(nil, nil, "Unliking requires an access token") unless access_token
        graph_call("#{id}/likes", {}, "delete", options, &block)
      end

      # Search for a given query among visible Facebook objects.
      # See {http://developers.facebook.com/docs/reference/api/#searching Facebook documentation} for more information.
      #
      # @param search_terms the query to search for
      # @param args object type and any additional arguments, such as fields, etc.
      # @param options (see #get_object)
      # @param block (see Koala::Facebook::API#api)
      #
      # @return [Koala::Facebook::API::GraphCollection] an array of search results
      def search(search_terms, args = {}, options = {}, &block)
        # Normally we wouldn't enforce Facebook API behavior, but the API fails with cryptic error
        # messages if you fail to include a type term. For a convenience method, that is valuable.
        raise ArgumentError, "type must be includedin args when searching" unless args[:type] || args["type"]
        graph_call("search", args.merge("q" => search_terms), "get", options, &block)
      end

View on GitHub (pinned to 47d052063e)

Solutions

1. Guard the session token before constructing the API: send the user back to login when session[:fb_token] is nil
2. Construct the API with the user's valid token and only then call delete_like
3. On Facebook deauthorization callbacks, clear local like state so the UI stops offering unlikes with a dead token
4. Rescue Koala::Facebook::AuthenticationError, restart OAuth, and retry the unlike once

Example fix

# before
def unlike
  api = Koala::Facebook::API.new(session[:fb_token]) # nil after expiry/logout
  api.delete_like(params[:post_id])
end

# after
def unlike
  token = session[:fb_token] or return redirect_to(login_path)
  api = Koala::Facebook::API.new(token)
  api.delete_like(params[:post_id])
end

return reauthenticate! unless api.access_token
api.delete_like(post_id)

begin
  api.delete_like(post_id)
rescue Koala::Facebook::AuthenticationError
  reauthenticate! # clear stale token, restart OAuth, retry the unlike once
end

When it happens

Trigger: api.delete_like(post_id) — or any unlike flow built on it — where the API instance was constructed without a token, e.g. Koala::Facebook::API.new(session[:fb_token]) with the session value expired or cleared to nil.

Common situations: Unlike buttons in controllers whose current_user token is nil after session expiry; tokens invalidated by password changes or Facebook app deauthorization while the UI still shows the like toggle; per-request API clients where one code path forgets to assign the token.

Related errors

• Batch operations require an access token, none provided.
• Delete requires an access token
• Write operations require an access token
• Koala::Facebook::ServerError.new(result.status.to_i, result.
• type must be includedin args when searching

AI-assisted analysis of arsduo/koala@47d052063e (2026-08-23). Data as JSON: /api/errors/8fecf3ae06d9e8da. Report an issue: GitHub.