# First set an environment variable for Facebook
SetEnvIf User-Agent ^facebookexternalhit.*$ Facebook=1

# In your password authentication on directory level, allow Facebook
...
        AllowOverride All
        AuthType Basic
        AuthName "Requires Authentication"
        AuthUserFile XXX
        Require valid-user
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1
        Allow from XXX.XXX.XXX.XX
        Allow from XXX.XXX.XXX.XX
        Allow from env=Facebook
        Satisfy Any