limited.facebook.com is the domain Meta uses for Limited Login on iOS when someone declines or has not granted App Tracking Transparency permission. The flow shares less data and returns an AuthenticationToken instead of the standard OAuth access token. If you maintain the app, request ATT permission, handle loginTracking and nonce, and validate the OIDC token. Android login is unaffected.
With Apple’s App Tracking Transparency (ATT) enforcement, Meta has made key updates to the iOS Facebook Login SDK. If a login redirects to limited.facebook.com, this is expected Limited Login behavior, not a fake domain or a separate Facebook service. When someone opts out of ATT or never grants consent, the SDK will not provide a valid OAuth access token. Graph API requests may then fail with an OAuthException that reports an invalid access token.
This guide explains what limited.facebook.com means and the practical changes required in an iOS app.
What is limited.facebook.com and Facebook Limited Login?
Facebook Limited Login is a privacy-focused alternative to the standard Facebook Login. It provides a lightweight authentication method that allows users to sign in to apps with their Facebook credentials while sharing only minimal information.
Unlike the full Facebook Login, which can grant apps access to a wide range of user data, Limited Login only supports basic profile details, such as name, profile picture, and email. Additionally, it ensures that user interactions with the app won’t be used for ad personalization or measurement, making it a more privacy-conscious option.
How to identify Limited Login attempts
The login screen provides the clearest signal. If someone has not granted App Tracking Transparency (ATT) consent or explicitly requests Limited Login, Meta redirects the login request to limited.facebook.com instead of facebook.com. The domain indicates that the person is signing in with restricted permissions.
What is the key difference from standard Facebook Login?
Traditionally, the Facebook Login returns an OAuth access token which can be used to request additional data from the Facebook Graph API. Development tools like Meta’s Access Token Debugger help you debug and access tokens that are returned from successful login attempts.
However, Limited Login works differently. Instead of an OAuth token, it returns an AuthenticationToken, which wraps an OpenID Connect (OIDC) token. This ID token has stricter limitations.
It cannot be used to:
Request additional data from the Graph API (e.g., friends, photos, or pages), or
Obtain other tokens, such as Page or session info tokens.
The full list of available datapoints that can be requested and returned with the AuthenticationToken is documented in the Facebook Developer documentation (See Limited Login for iOS).
Unlike standard OAuth tokens, the AuthenticationToken from Limited Login cannot be debugged using Meta’s Access Token Debugger. Instead, validation must be done manually by:
Validating the JWT format,
Validating the JWT Signature, and
Checking the Standard claims of the JWT payload.
For a step-by-step guide on decoding and validating the OIDC token, refer to the Facebook Developer documentation: Validating the Limited Login OIDC Token.
Get hands-on with Median’s comprehensive documentation, and build your app with ease.
What do I have to do when updating my app?
If you're updating your app and upgrading to Facebook Login SDK version 17.0.0 or higher, here are the steps you need to follow for your iOS app:
Request ATT permissions: Before allowing users to log in, it’s crucial to request App Tracking Transparency (ATT) permission. If the permission is not requested or not granted by the user, Facebook will automatically redirect users to limited.facebook.com and provide the Limited Login experience by default.
Note changes to the Login button: When implementing Limited Login, there are two new properties you’ll need to be aware of:
loginTracking: This property controls the tracking preference for login attempts. By default, it is set to .enabled, but developers can adjust it based on their app’s requirements.
nonce: This property allows you to set an optional nonce for login attempts. A valid nonce must be:
A non-empty string
Free of whitespace
If an invalid nonce is provided, it won’t be set, and the SDK will generate a default unique nonce automatically for login attempts.
3. Leave the Logout button alone.
No changes are required to your app’s logout button when adopting Limited Login. The Facebook SDK automatically handles token invalidation for both standard and limited logins.
4. Apply changes to the Login flow.
When integrating Limited Login, ensure your app processes authentication attempts just like traditional Facebook Login.
Here’s what you need to do:
Ensure your system can recognize and handle successful Limited Login attempts
Properly process the returned AuthenticationToken
Manage user data consistently, whether the login is standard or limited
How are my app’s users impacted by Facebook Limited Login?
If you're considering the changes introduced by Limited Login in your app, you might wonder how it impacts existing logged-in users. There’s no immediate effect because users who are already logged in can continue using your app as usual.
However, if you want existing users to benefit from Limited Login safeguards, they will need to log out and sign back in using Limited Login.
Facebook Limited Login only applies to iOS. Android users remain unaffected, as these changes are specific to accommodate Apple’s App Tracking Transparency (ATT) policies.
Unlock Median’s 500+ free Figma app store screenshot templates designed to meet iOS and Android guidelines. Your app will look its best across platforms, resulting in more downloads and a more powerful app store presence.
Summary
Meta has updated the Facebook Login SDK to version 17.0.0+ to comply with Apple’s App Tracking Transparency (ATT) enforcement.
The changes introduce Facebook Limited Login, a privacy-focused authentication method that provides users with minimal data sharing, by default only including their name, profile picture, and email.
Developers of iOS apps need to request ATT permissions, ensure proper handling of the new login flow, and be aware of the changes to the login and logout buttons.
Frequently asked questions
What is limited.facebook.com?
limited.facebook.com is the Meta domain used for Facebook Limited Login on iOS. It appears when someone has not granted ATT permission or chooses the limited login flow.
How does Facebook Limited Login differ from the standard Facebook Login?
Unlike the standard Facebook Login, which shares extensive user data with third-party applications, Facebook Limited Login restricts the amount of personal information shared. This includes limiting access to the user's profile picture, email, and friends list, ensuring greater control over personal data.
Can Limited Login be integrated with webview apps?
Yes. A webview app can use Facebook Limited Login, but the app must handle the AuthenticationToken and the ATT-dependent login flow correctly.
*DISCLAIMER: This content is provided solely for informational purposes. It is not exhaustive and may not be relevant for your requirements. While we have obtained and compiled this information from sources we believe to be reliable, we cannot and do not guarantee its accuracy. This content is not to be considered professional advice and does not form a professional relationship of any kind between you and GoNative.io LLC or its affiliates. Median.co is the industry-leading end-to-end solution for developing, publishing, and maintaining native mobile apps for iOS and Android powered by web content. When considering any technology vendor we recommend that you conduct detailed research and "read the fine print" before using their services.*
