Update: I've pinpointed the problem and found a possible solution. In Facebook.php an existing array named $config is merged with the info from the getenv() calls. Since the existing array has empty values for app_id (and app_secret) and it is the second parameter, the values from the first array are overwritten with empty values in the final $config variable:

$config = array_merge([
    'app_id' => getenv(static::APP_ID_ENV_NAME),
    'app_secret' => getenv(static::APP_SECRET_ENV_NAME),
    'default_graph_version' => static::DEFAULT_GRAPH_VERSION,
    'enable_beta_mode' => false,
    'http_client_handler' => null,
    'persistent_data_handler' => null,
    'pseudo_random_string_generator' => null,
    'url_detection_handler' => null,
], $config);

If I switch the parameters for the array_merge call, it seems to work:

$config = array_merge($config, [
    'app_id' => getenv(static::APP_ID_ENV_NAME),
    'app_secret' => getenv(static::APP_SECRET_ENV_NAME),
    'default_graph_version' => static::DEFAULT_GRAPH_VERSION,
    'enable_beta_mode' => false,
    'http_client_handler' => null,
    'persistent_data_handler' => null,
    'pseudo_random_string_generator' => null,
    'url_detection_handler' => null,
]);

I'm not yet sure if this solves all problems, but I find it strange. How come this doesn't happen to all the other tens of thousands of people that use this package?

Mmm, I had this error appear a lot of times. I think most of them were because the redirect URL was wrong.

i.e.:

• one time, I went to facebook developer, settings->advanced->whitelist redirect urls (or something like that, alusive to "allowed urls") and I put my local url "http://myproject.dev/auth/login/facebook". BUT, I forgot to hit "save" on the facebook page.

• some other lots time, I had my local url wrong.

• on one occasion, the redirect url was fine but i had an error on the controller, not handling well the redirect.