I Have seen alot of sample where the API key is hard coded into, unless you are building a desktop there is no need to do this. Facebook provides the API key, and the session key in the iframe url. Your application should retrieve the keys from the url, this makre your code more portable.
Url Variables:
- fb_sig_api_key
- fb_sig_session_key
- fb_sig_ss
UPDATE – 9/10/10
With the new changes to face book app, make sure that you go into the advanced setting and check canvas session parameters.
In my experience i have found that using the JavaScript client library for Facebook and the External Interface API in flash is alot more responsive than the Adobe Facebook AS3 library. Sometimes the event fails to fire. The only time you should use the adobe library is when you need to upload fotos, and do so by sharing the session data used by the JavaScript client.
Example of sharing a session:
fb= new Facebook();
var session:WebSession;
session=new WebSession(Application.application.parameters.fbsigapikey,
Application.application.parameters.fbsigss,
Application.application.parameters.fbsigsessionkey);
session.addEventListener(FacebookEvent.CONNECT, function():void{
var bytes:ByteArray = jpegencoder.encode(lastpumpyourselfbm.bitmapData);
var call:UploadPhoto = new UploadPhoto(bytes);
fb.post(call);
});
fb.startSession(session);
session.verifySession();
Designed By: Charlie Guerrero & Ryan Raulie
Developed By: Myself and co-developed with Aaron L’Heureux
Technology: PHP, Flash, jquery and XML
Website: http://www.berkleevalencia.org/en/

Berklee Valencia Homepage

Berklee Valencia Interior page
Technology: HTML, Javascript

United States Distric Court