I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password).

No matter which method the user chooses, they should remain login until they choose to logout.

While signing up as a new user is straight forward, using username/password as authentication, I have no idea how I can authentication users who signs up with facebook/twitter. I think there’s an access token returned when user gives access to our app, but is this token permanent? Can we reliably store it in our database for authentication?

Any advice is appreciated.