Tuesday, May 15, 2012

Why does Facebook app registration require a real account?


Tried googling for any good rationale behind this, and didn't come up with any answers. A couple of months ago, I was implementing a cross-domain SSO solution with support for delegated social authentications. As of then, I was not on any of the social networking sites. I have a handful of good friends, and I do manage to touch base with them regularly – mostly, on a one-to-one basis. So, for my individual case, i haven't felt any real need for networking over social sites - as yet. Also, if you have the slightest introverted streak - you may tend to agree with me that online social chatter, on an extended basis - as is true of real world socializing too – can generally get a bit too demanding & noisy for comfort.

So, here I started with the naive assumption that i just had to create my dev profiles with these social providers – acquire my dev tokens & test my stuff on the respective test-beds with test users; before pointing to production urls. A little reading-up on the Facebook dev-site, & i realize that though short-lived test-users are supported for a registered application, you need a real profile to register your app in the first place!

Whereas a Twitter account (dummy) & app was quick to setup - no challenges thrown, no verifications asked for; with Facebook, it was altogether different! My first naive attempt on FB was to instinctively choose a username with the word "dev" in it - result was an outright rejection - no test user registrations allowed – which makes perfect sense, as you would want to keep your userbase clean and “real”. I had even tried creating a dummy account with human names - which got rejected as “fake” at the point of adding my app (their fake-detection is incredibly strong!).

So, created a genuine profile & jumped straight to the developer's section - to be thrown the next hurdle - an sms/credit-card based profile-verification. Went through that, and jumped back again to developer's section to add my app. That worked - for the time-being. Sometime later, i had switched back to my local dev environment – so, wanted to add my local app as well. That caused FB to challenge me to verify my profile all over again! Got myself verified again – and if I remember right, trying to add my second app again got me another lockout. With every challenge, the verification sms took longer to come – the delay had quickly shot up to a couple of hours! - probably some throttling policy in place there to limit your number of attempts. So, after a third-time verification, I decided to keep myself content with configuring just a single environment’s app under my profile.

I learnt from another developer (who is, of course, an active FB user too) - that he had faced no such issues while trying to add multiple applications. Perhaps the fact that i was a freshly registered user - with not even friends added! - my only activity being around adding apps - might have triggered a red-flag, causing frequent challenges to be thrown my way.

As a developer, the whole thing is clearly counter-intuitive - that i cannot be purely a developer solely interested in your API, without also being an end-user of your system. And not just simply a bonafide end-user whose identity needs to be ascertained once – if you must; but an active end-user at that! As developers, we integrate with a host of systems we may never even get a chance to use ourselves as a real end-user – we might be interested in just talking to a part of their exposed API. And we want to start talking - to get up & running - as quick as possible. We want to face real integration challenges, and not pointless hurdles.