Hot answers tagged

9

Some comments on the new features: Authentication I really dislike an authentication flow which mandates a call out to a browser. It makes command line applications basically impossible. It makes consistent UIs for specific platforms very hard (e.g. iPhone), as you basically have to dump the user into a web browser with an entirely different UI. It also ...


8

The implicit flow uses the url https://stackexchange.com/oauth/dialog, not https://stackexchange.com/oauth. You should just need to change the url, otherwise that looks correct.


8

I would like to see fixed paging. And yes, that means I think the current system is broken. What do I mean by broken? When you want to get 500 newest questions and the page size is 100, it's impossible to do so without the possibility of duplicates (which are easy to ignore) or (much worse) missing questions. This happens because you can access page 1, ...


7

I would be interested in seeing a /me/votes route to get a list of all my upvotes and downvotes. Note that this would only apply to my voting history and not anyone else's.


6

Oy, that was an annoying one. Subtle, as the bug only happened when you're not logged in but would be automatically logged in when you visit stackexchange.com. The actual root cause was just over-encoding a url.


6

The fix for me was unchecking "Enable Client Side OAuth Flow"


5

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet. Crucial Points: Do not specify a redirect_uri to any server that you do not control!!! When you use something like redirect_uri=https://www.yahoo.com/, then a ...


5

I had a similar issue a few months ago ago, and I came up with a couple of suggestions, one exactly like how you suggested: Ask the user for the email associated with their account, MD5 it, and compare it to the value provided by the API. This works, provided it isn't essential that the user is who he says he is - a users email may be publicly available, ...


4

There is none in version 1.1 of the API: all the information in the API is public. This is status-planned for version 2, however. Read more.


4

Your second call must be https:. You actually got an error like: "error_id":406, "error_message":"Access token sent over non-HTTPS request, it has been invalidated", "error_name":"access_token_compromised" On the first attempt. Only subsequent attempts, with the same token, would yield the 'key' is not valid for passed 'access_token' error. When ...


3

I forgot to add the scope in the authentication url according to this document https://api.stackexchange.com/docs/authentication#scope 1.Send a user to https://stackexchange.com/oauth, with these query string parameters ◦client_id ◦scope (details) ◦redirect_uri - must be under an apps registered domain ◦state - optional


3

So, this was a fun one. :) We apparently broke several different things over the course of a year that went unnoticed until Google turned off OpenID support. In no particular order but for fun and posterity: Facebook OAuth authentication just straight up didn't work. It broke back in January of 2014 when the code was accidentally changed from function ...


3

This is relatively easy - just make him give you the same email address that he provided for his Stack Exchange account and then calculate the MD5 hash of the email address. Then compare that to the email_hash member of his account data. If the two hashes match, then the user is indeed who they claim to be. If not, they either provided a different email ...


3

Reference: Stack Exchange API Authentication Looking for a beginner's tutorial to using the API Yeah the registration form now says, "Website URL is required". So, if you don't have your own website: Enter stackexchange.com as the Application Website. Enter stackexchange.com as the OAuth Domain. This will allow you to use https://stackexchange....


3

DNS went wonky on our end, this has been fixed, those responsible have been beaten. While there's a chance it still won't resolve for some folks, all that should shake itself out within the next 15 minutes or so.


3

Yes, I always get 86399 too. And, no, you can't specify an interval other than no_expiry. But you can call /access-tokens/{accessTokens}/invalidateDoc at whatever interval you wish. So, for less user annoyance, set no_expiry but then call /invalidate every, say, 8 days, for example.


2

key is your app key, access_token identifies a user (and a set of permissions) and is what you get at the end of an authentication flow. Keys are not secret, for example here's what the Documentation Console's registration looks like: You can find your app key by going to Manage Your Applications (in the Stack Apps homepage sidebar) and selecting one of ...


2

I've updated the documentation with a section about errors. This behavior is defined more by the OAuth 2.0 spec than by me, so it's naturally a little out of sync with the rest of the API. Authentication is also just... weird when compared to pure data queries. The answer is, it depends. In no case during implicit authentication is a 400 possible, sine ...


2

This isn't possible, for simplicity reasons. Right now there are a few states a user can get into w.r.t. authentication: logged in, app not authorized need to authorize app app not in app tab logged in, app authorized no prompt app in app tab not logged in, app not authorized need to login, then authorize app app not in app tab not logged in, app ...


2

The authentication process is described in the API docs: http://api.stackexchange.com/docs/authentication.


2

I found answer myself and posted in my blog post StackAlert Firefox Extension error key is not valid for passed access_token Solution in brief When you remove the application from StackExchange apps, and even after uninstalling the extension from Firefox, you will still have traces of that extension in Firefox. To make this extension work again, we have ...


2

I faced the same issue when I was using the stack exchange API to post a message to stack overflow website. I figured I had to post my application on a domain name. I hosted my application on free domain provided by 000webhost.com. You may wish to take a similar approach. After deploying the application on the domain, change the oauth domain and the ...


2

The token does not appear because of the way urllib2 handles the redirect. I am not familiar with the details so I won't elaborate here. The solution is to catch the 302 before the urllib2 handles the redirect. This can be done by sub-classing the urllib2.HTTPRedirectHandler to get the redirect with its hashtag and token. Here is a short example of ...


2

Yes, each time you invoke stackexchange.com/oauth/ you will get a fresh access token, even though old ones may still be valid. For example: Go to /me/inboxLivedoc and hit Get Token twice, recording the token value each time (It will always be different). Then go to /access-tokens/{accessTokens}Livedoc and check each token. They will both still be valid! (...


2

Refer to the API Authentication doc page, where it says: explicit grant (is) for server side applications Also, see What is the difference between the 2 workflows? and related questions. Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a ...


2

Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms: "Explicit" "Implicit" "Server side" "Client side" a little interchangeably. (The first 2 are roughly synonymous with the last two.) From the javascript SDK docs: Your application must have the client side OAuth flow enabled, and must not have the ...


1

Refer to the generic URI syntax, it is perfectly valid to have a fragment (The optional part of a URL that starts with an octothorpe #) without a preceding query (The optional part of a URL that starts with a question mark ?). This is how Stack Exchange returns tokens and other API's have used the same approach. There is nothing wrong with it. In fact, it ...


1

Fixing WebBrowser Control I also had the issue of the WebBrowser control handing when trying to login. Although requesting a token in IE (11) works, I found that IE itself also hangs when I put it in IE 7 emulation mode. This suggested to me that my previous attempt to make the WebBrowser control use a newer version had failed. I found this article, Web ...


1

That error means that you've used an invalid id or that the settings on your app page are incorrect. Do the following: Go to Your Apps page. You should see your app listed. If it is not, then register a new app. Click on your app's settings page. For example: stackapps.com/apps/oauth/view/3996. Note that only the owner can see a given app's settings ...


1

Yes, you can use a local environment to develop. For example, this answer contains a complete start to authenticating an HTML+javascript app. All it requires is for you to run XAMPP (or similar server) on your local machine. If you don't need authorization, you can even host your app on one of the free services. For example, this single-web-page app ...



Only top voted, non community-wiki answers of a minimum length are eligible