I have an Android app using Facebook to login.
The app is already public:

Unlike Google, Facebook api needs a valid ssl certificate. So if your website isn't https then according to facebook you are still in development mode. Here is the link to their docs https://developers.facebook.com/docs/apps/security
For development purposes you can use the roles option (can be found on the leftside menu). In here you can enroll your self as a developer or tester to use all the live features.
Once you are done with the development you will have to get an ssl certificate. You can also use a free service like https://letsencrypt.org to get a valid certificate, facebook requires your certificate to be sha256WithRSAEncryption, i personally haven't used letsencrypt with facebook yet but they are one of their sponsors to i guess it should meet their criteria of a decent certificate.