Facebook clients are plain OAuth2 — no OIDC. They never issue an id_token — exactly like the real provider, which does not implement OIDC. An app integrating Facebook must fetch the profile endpoint below with the access token.
Token response quirks
Section titled “Token response quirks”token_typeis"bearer"(lowercase) — as the real provider returns it. Token-type comparisons in your app should be case-insensitive per RFC 6750; if yours isn’t, you’ll hit it here first rather than in production.expires_inis present (3600), as the real provider returns it.scopeis omitted from the token response, as the real Graph API does.
Facebook also accepts the token exchange as GET or POST — the real Graph API uses GET — while all other providers require POST.
Fetching the user profile
Section titled “Fetching the user profile”Facebook clients expose the real provider’s profile API, so your app’s provider adapter works unmodified — GET /me with the Bearer token returns { "id", "name", "email" }, like the Graph API.
Facebook clients ignore PKCE parameters, mirroring the real provider’s web application flow, which has no PKCE. Sending code_challenge to those clients is harmless — it is simply not enforced.