The error occurs because the application verifier token that was specified for the msgr:app tag has expired. A computed application verifier token is valid for 60 minutes.
We have received some feedback regarding the issue you are describing. Most likely we will introduce a change in one of our upcoming hot-fix releases for this scenario, where the resource defined by the “token-url” attribute of the msgr:app tag will be used to refresh the application verifier token.
In the interim, a possible solution is to have a client side timer that refreshes the page so that a new application verifier token is computed.
Few thinks are worth noting here:
· Once the user has consented and successfully signed-in, the Messenger Web Toolkit will refresh the delegation token as needed and the user can remain signed-in the page even if the application verifier token has expired.
· Application that store consent tokens, can automatically sign-in the user, without requiring the user to go through the consent flow.
Hope this helps,
Offir Bakshitz [MSFT]