Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set an OAuth domain for an application (the client_id is 24) and the following link authorizes the application:,read_inbox&redirect_uri=

I can assure you that the redirect_uri is not within the registered domain for my application.

Why is this not producing an error?

share|improve this question
I think the only URL outside the registered domain that is accepted is, because it's on StackExchange it's trusted already. – Jonathan. Jan 19 '12 at 21:34
@Jonathan: Yeah, but that isn't documented anywhere. – Nathan Osman Jan 19 '12 at 22:05
up vote 2 down vote accepted

This is .

You'll note on the authentication documentation:

Desktop applications cannot participate directly in OAuth 2.0 flows, however the embeddable browser controls available in most frameworks make it possible to work around this limitation.

Desktop applications should use the implicit client-side flow, hosting the process within a browser control. For redirect_uri, a value of should be used. Upon a successful authentication, access_token will be placed in the url hash as with a standard implicit authentication.

However, I can see that some developers may want the peace of mind that comes from this not being available.

You can now disable this behavior on your application's edit page.

enter image description here

share|improve this answer
Ah, thanks for the clarification. – Nathan Osman Jan 20 '12 at 1:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .