1. client access token
-> you aren’t running your own servers
-> simpler to implement
-> long-lived token
2. authorization code (more secure)
-> all other cases
-> requires extra steps server-side
-> client never sees the token
repositories { jcenter() } allprojects { repositories { jcenter() } } dependencies { compile 'com.facebook.android:account-kit-sdk:4.+' }