Facebook API does have a method where you can revoke the permission automatically (ie when you no longer need it). And also if you don't request offline_access

Facebook API does have a method where you can revoke the permission automatically (ie when you no longer need it). And also if you don't request offline_access permission, the token is only valid for an hour or two. But yes, Facebook doesn't make this very clear to the user.