diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# Version 1.9.1
+
+* Only pass `code` query param to getUserAccessTokenStep2
+
 # Version 1.9.0
 
 * Supports conduit >= 1.3.0
diff --git a/src/Yesod/Auth/Facebook/ServerSide.hs b/src/Yesod/Auth/Facebook/ServerSide.hs
--- a/src/Yesod/Auth/Facebook/ServerSide.hs
+++ b/src/Yesod/Auth/Facebook/ServerSide.hs
@@ -72,7 +72,7 @@
         tm <- getRouteToParent
         query  <- queryString <$> waiRequest
         let proceedUrl = render $ tm proceedR
-            query' = [(a,b) | (a, Just b) <- query]
+            query' = [(a,b) | (a, Just b) <- query, a == "code"]
         token <- liftSubHandler $ YF.runYesodFbT $ FB.getUserAccessTokenStep2 proceedUrl query'
         setUserAccessToken token
         setCredsRedirect (createCreds token)
diff --git a/yesod-auth-fb.cabal b/yesod-auth-fb.cabal
--- a/yesod-auth-fb.cabal
+++ b/yesod-auth-fb.cabal
@@ -1,5 +1,5 @@
 Name:                yesod-auth-fb
-Version:             1.9.0
+Version:             1.9.1
 Synopsis:            Authentication backend for Yesod using Facebook.
 Homepage:            https://github.com/psibi/yesod-auth-fb
 License:             BSD3