node.js - Passportjs Facebook login flow (passport-facebook vs passport-token) -

working node, express, , passport.

okay, team , building rest api dual-sided marketplace type application. have set basic localstrategy email , password login.

we want make api user-agent agnostic, can use api via web, android, or ios.

but getting confused fb login flow. question is, goes on behind scenes in passportjs. have looked 'passport-facebook' , 'passport-facebook-token' strategies, , can't decide 1 go with.

this current understanding of flow:

if correct, better off having client access_token fb sending me, or letting fb handle via redirects , callback url?

passport-token:

passport.use('facebook-token', new facebooktokenstrategy( {     clientid: 'xxx',     clientsecret: 'xxx' }, function(accesstoken, refreshtoken, profile, done) {     // asynchronous     //console.log("into passport auth");     process.nexttick(function() {         user.findone({'facebook.id': profile.id}, function(error, user) {             console.log("user " + json.stringify(user));             console.log("profile " + json.stringify(profile));              //do user creation stuff etc.              return done(error, user);         });     }); }));  authrouter.post('/facebook', passport.authenticate('facebook-token'), function (req, res) {     console.log("into controller");     if (req.user){         //log user in since authenticated facebook.         req.login(user);         res.status(200).end();     } else {         res.status(401).end();     } }); 

passport-facebook:

passport.use('facebook', new facebookstrategy( {     callbackurl: "http://75.128.65.176:8080/auth/facebook/callback",     clientid: 'xxx',     clientsecret: 'xxx' }, function(accesstoken, refreshtoken, profile, done) {     // asynchronous     //console.log("into passport auth");     process.nexttick(function() {         user.findone({'facebook.id': profile.id}, function(error, user) {             console.log("user " + json.stringify(user));             console.log("profile " + json.stringify(profile));              //do user creation stuff etc.              return done(error, user);         });     }); }));  // redirect user facebook authentication.  when complete, // facebook redirect user application @ //     /auth/facebook/callback authrouter.get('/facebook', passport.authenticate('facebook'));  // facebook redirect user url after approval.  finish // authentication process attempting obtain access token.  if // access granted, user logged in.  otherwise, // authentication has failed. authrouter.get('/facebook/callback',     passport.authenticate('facebook', { successredirect: '/',                                   failureredirect: '/login' })); 

any details/elaboration on how flow works appreciated!

the client side facebook redirects inconvenient when using native ios , android facebook sdks - redirect user installed facebook app instead. hence if generic api should go passport-facebook-token.