public String computeAppSecretProof(final String url, final OAuth2AccessToken token, final FacebookConfiguration configuration) {
        try {
            var sha256_HMAC = Mac.getInstance("HmacSHA256");
            Key secret_key = new SecretKeySpec(configuration.getSecret().getBytes(StandardCharsets.UTF_8), "HmacSHA256");
            sha256_HMAC.init(secret_key);
            var proof = Hex.encodeHexString(sha256_HMAC.doFinal(token.getAccessToken()
                .getBytes(StandardCharsets.UTF_8)));
            val computedUrl = CommonHelper.addParameter(url, APPSECRET_PARAMETER, proof);
            return computedUrl;
        } catch (final InvalidKeyException | NoSuchAlgorithmException e) {
            throw new TechnicalException("Unable to compute appsecret_proof", e);
        }
    }
The code in this method is based on this blog post:
https://www.sammyk.me/the-single-most-important-way-to-make-your-facebook-app-more-secure
and this answer: https://stackoverflow.com/questions/7124735/hmac-sha256-algorithm-for-signature-calculation

@param url the URL to which we're adding the proof
@param token the application token we pass back and forth
@param configuration the current configuration
@return URL with the appsecret_proof parameter added
pac4j-oauth/src/main/java/org/pac4j/oauth/profile/facebook/FacebookProfileDefinition.java