What can a Canvas app do that an external site using Facebook's SDK cannot?

Question

I've read Facebook's documentation for Canvas apps several times, but I'm having a hard time telling which features are available only to Canvas apps and which features are also available to non-Facebook websites that use the JavaScript SDK.

For example, the Canvas documentation mentions Bookmarks, Search, and publishing to the News Feed via the Feed Dialog and Graph API. But you can get all of that on a non-Facebook website, without being a Canvas app, by using the Facebook Login API and Feed Dialog API.

So, what exactly are the features of Canvas? What can a Canvas app do that an ordinary website can't?

Answer 1

The obvious difference is that a Canvas app lives on a Facebook page, while an external app lives on your own site.

The more surprising difference has to do with Facebook's Platform Policies as they apply to apps that are defined as "games."

In particular, there's a rule that applies only to games on external Facebook websites, per 9.2.a:

Desktop web games off of Facebook.com may only use Facebook Login (Authentication, excluding user connections such as friend list), Social Plugins and publishing (e.g., Feed Dialog, Stream Publish, or Open Graph). When authenticating, these games may not request additional permissions other than age, email, and our Publishing Permissions.

If you're an external site using Facebook's SDK, you can do all of the above and more, but if your external site is a game, you'll be in violation of Facebook's terms if you try to request additional permissions, read players' friend lists, or use additional Facebook APIs.

If your app is a game, and you want full access to Facebook's API, you have to convert your external site to a Canvas app, and then you have to follow others of Facebook's rules (especially notable: you must accept Facebook Credits exclusively, which gives Facebook a 30% cut of your in-app revenue).

If you're a non-game app, the only benefit of being a Canvas app is the facebook.com URL.

(You yourself are responsible for telling Facebook whether you're a game or not; it's possible to lie to Facebook by configuring your game to use a non-game app category. But if your game gets popular enough, Facebook will notice, and penalize you for violating their terms, so don't do that.)

Answer 2

That is not the only advantage. Here is a message direct from the FB Graph API (v2.10)

    {
      "error": {
        "message": "(#200) Only web canvas apps can send app notifications",
        "type": "OAuthException",
        "code": 200,
        "fbtrace_id": "EkUFajtj0Iq"
      }
    }