And then the external site sends an HTTP request (with access token for authentication) to Facebook’s API. Facebook then asks you whether to provide the details or not.