We are using an Auth Provider and Facebook app to allow users to single sign on to our Salesforce community using their Facebook login.
Now Facebook are requesting access to the community to 'review' our usage of the Facebook app. Email from Facebook below (there was also a notification in the alerts section of the Facebook app, so it is genuine):
In order to keep our Facebook platform and community safe, we periodically review apps for compliance. Your app is being reviewed and we need the following information or action from you in order to approve your app’s continued operation on our platform. - Detailed instructions describing how our reviewers can access your platform - Valid credentials for us to login to your app and test/review its functionality and its use of any Facebook API integration Notes regarding the above: - The credentials on the test account you provide for us to access must be valid indefinitely - The experience, once we have accessed your platform for review, must be accurately representative of an organic user experience - We will potentially be testing any/all Facebook API integrations you have for compliance under our platform policies: https://developers.facebook.com/policy/ To continue operating on our platform, we will need to be able to complete a review of your app. Kindly reply back to this email with the requested information. If we do not receive a response by 2020-07-06 12:00 PST, your app will be subject to enforcement. Thank you for your cooperation in our continued efforts to keep our platform safe. - Facebook Developer Operations Team
Has anyone experienced this, and how did you resolve it?
We don't want to give them access to our community if we can avoid it, as it is a private community that contains personal data. Nor do we want to create a test user in Production for Facebook to use. As we are using standard Salesforce functionality (https://help.salesforce.com/articleView?id=sso_provider_facebook.htm&type=5), and are only using the base permissions a Facebook app comes with, we don't see the need for a review but Facebook are being persistent.