code: public static String getAccessToken(String clientId, String clientSecret, String code, String redirectUri) {
  		RequestBuilder call = new RequestBuilder(GRAPH_ENDPOINT + "oauth/access_token", HttpMethod.GET);
  		call.setTimeout(10 * 1000);	// this is a somewhat crude hack but seems reasonable right now
  		call.addParam("client_id", clientId);
  		call.addParam("client_secret", clientSecret);
  		if (code != null || redirectUri != null) {
  			call.addParam("code", code);
  			call.addParam("redirect_uri", redirectUri);
  		} else
  			call.addParam("grant_type", "client_credentials");
  		
  		try {
  			HttpResponse response = call.execute();
  			
  			// Yet more Facebook API stupidity; if the response is OK then we parse as urlencoded params,
  			// otherwise we must parse as JSON and run through the error detector.
  			if (response.getResponseCode() == 200) {
  				return URLParser.parseQuery(StringUtils.read(response.getContentStream())).get("access_token");
  			} else {
  				Later<JsonNode> json = new Now<JsonNode>(new ObjectMapper().readTree(response.getContentStream()));
  				new ErrorDetectingWrapper(json).get();	// This should throw an exception
  				throw new IllegalStateException("Impossible, this should have been detected as an error: " + json);
  			}
  		} catch (IOException ex) {
  			throw new IOFacebookException(ex);
  		}
  	}
docs: Get a user access token from Facebook.  Normally you obtain this from the client-side SDK (javascript, iphone, etc)
  but if you are driving the OAuth flow manually, this method is the last step.
  
  see https://developers.facebook.com/docs/authentication/