Hot answers tagged

5

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet. Crucial Points: Do not specify a redirect_uri to any server that you do not control!!! When you use something like redirect_uri=https://www.yahoo.com/, then a ...


3

Yes, I always get 86399 too. And, no, you can't specify an interval other than no_expiry. But you can call /access-tokens/{accessTokens}/invalidateDoc at whatever interval you wish. So, for less user annoyance, set no_expiry but then call /invalidate every, say, 8 days, for example.


3

So, this was a fun one. :) We apparently broke several different things over the course of a year that went unnoticed until Google turned off OpenID support. In no particular order but for fun and posterity: Facebook OAuth authentication just straight up didn't work. It broke back in January of 2014 when the code was accidentally changed from function ...


2

The authentication process is described in the API docs: http://api.stackexchange.com/docs/authentication.


2

Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms: "Explicit" "Implicit" "Server side" "Client side" a little interchangeably. (The first 2 are roughly synonymous with the last two.) From the javascript SDK docs: Your application must have the client side OAuth flow enabled, and must not have the ...


2

Refer to the API Authentication doc page, where it says: explicit grant (is) for server side applications Also, see What is the difference between the 2 workflows? and related questions. Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a ...


1

Yes, each time you invoke stackexchange.com/oauth/ you will get a fresh access token, even though old ones may still be valid. For example: Go to /me/inboxLivedoc and hit Get Token twice, recording the token value each time (It will always be different). Then go to /access-tokens/{accessTokens}Livedoc and check each token. They will both still be valid! ...


1

Refer to the generic URI syntax, it is perfectly valid to have a fragment (The optional part of a URL that starts with an octothorpe #) without a preceding query (The optional part of a URL that starts with a question mark ?). This is how Stack Exchange returns tokens and other API's have used the same approach. There is nothing wrong with it. In fact, it ...



Only top voted, non community-wiki answers of a minimum length are eligible