2

Does this Stack Exchange API endpoint count towards quota usage? :

http://api.stackexchange.com/docs/read-access-tokens

(This is the most promising API call I found for verifying the validity of an access_token.)

I'm doing user authentication, not Stack Exchange API calls.
My application's cache acts as the first level for checking whether a user is still logged in, but when a call slips through, it has to hit some API call on Stack Exchange API to verify whether the token is still valid.


Which gets me to my second question:
Is there a purpose-built endpoint just for verifying the validity of an access_token?
GitHub apparently has:

#check-an-authorization ("OAuth applications can use a special API method for checking OAuth token validity without running afoul of normal rate limits for failed login attempts")

1 Answer 1

3

Yes, calls to /access-tokens/{accessTokens} use API quota. You can see that by repeatedly running /2.2/access-tokens/XBWL0stf*YIOCl7WpJHqYA)) for example.
With each call, the quota_remaining value will decrease.

However, there is no reason that the token check has to use the same key as your main app. The token check and your main app would then use separate 10K quotas. (You can see this in action by comparing the different quota values between, say, this page and this page.)


As for checking if an access_token is valid, merely use the /access-tokens/{accessTokens} route.

If the access_token is valid, that route returns a response like this (default filter):

{
  "items": [
    {
      "scope": [
        "read_inbox"
      ],
      "account_id": 131474,
      "expires_on_date": 1415948311,
      "access_token": "XBWL0stf*YIOCl7WpJHqYA))"
    }
  ],
  "has_more": false,
  "quota_max": 10000,
  "quota_remaining": 9956
}


If the access_token is invalid or expired, that route returns a response like this (default filter):

{
  "items": [],
  "has_more": false,
  "quota_max": 10000,
  "quota_remaining": 9946
}

If you pass more than 1 token to /access-tokens/{accessTokens}, only the valid ones will be in the items array of the response.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .