Usually you put a filter mechanism so some endpoints are restricted. This checks for a valid token sent by the client (by sending it back to facebook). If you f

Usually you put a filter mechanism so some endpoints are restricted. This checks for a valid token sent by the client (by sending it back to facebook). If you find this procedure slow you can also use good old sessions (although some people consider this stateful and thus not appropriate (I am not in this camp).