I don't know is it bug or feature. But when you log in with facebook button it sets cookie name like fbs_ApiKey.
But in vendor/php-sdk/src/facebook.php cookie name is like this:
protected function getSessionCookieName() {
return 'fbs_' . $this->getAppId();
}
And so, when you want to get access token, you are using getSession(). And if you use cookies, you wouldn't get correct access token(because you are using wrong cookie name).