Tag Info

Hot answers tagged

4

You can register apps that aren't web apps. This page: http://api.stackexchange.com/docs/authentication, gives details for registering a Desktop Application. A mobile phone app comes under the category of a desktop application. You should use the implicit flow, so check the box at the bottom of registration form, and for the OAuth domain use: ...


4

The OAuth domain name is the domain name that will be used to restrict the value of the redirect_uri parameter when authenticating from your application. This is done as a security precaution to prevent others from using your API key and redirecting to a domain name that does not match the one specified in the registration form. The API documentation page ...


3

We moved from nginx to HAProxy for our SSL provider this weekend as part of a larger rollout. In the move, we shifted our header checks to the now de-facto standard SSL protocol header. While I thought I fixed all the apps relying on the old header and standardized everything internally, stackexchange.com was left out and thought your auth requests weren't ...


3

This was fixed in the latest deploy.


2

The fix for me was unchecking "Enable Client Side OAuth Flow"


2

I found answer myself and posted in my blog post StackAlert Firefox Extension error key is not valid for passed access_token Solution in brief When you remove the application from StackExchange apps, and even after uninstalling the extension from Firefox, you will still have traces of that extension in Firefox. To make this extension work again, we have ...


2

The implicit flow uses the url https://stackexchange.com/oauth/dialog, not https://stackexchange.com/oauth. You should just need to change the url, otherwise that looks correct.


2

Well, my bad - I forgot to set the Content-Type header. Fixed code snippet: def oauth_explicit_two(client_id, client_secret, code, redirect_uri): params = {'client_id': client_id, 'client_secret': client_secret, 'code': code, 'redirect_uri': redirect_uri} headers = {'Content-Type': 'application/x-www-form-urlencoded'} # <--- ...


1

This is status-bydesign. You'll note on the authentication documentation: Desktop applications cannot participate directly in OAuth 2.0 flows, however the embeddable browser controls available in most frameworks make it possible to work around this limitation. Desktop applications should use the implicit client-side flow, hosting the process ...


1

If a user has any authorized applications, the apps tab appears on their profile pages. From the page linked a user can see their authorized applications, and de-authorize any of them. That link probably won't be conditionally displayed forever, but we haven't got anything to show in the "emtpy" case just yet.


1

The token does not appear because of the way urllib2 handles the redirect. I am not familiar with the details so I won't elaborate here. The solution is to catch the 302 before the urllib2 handles the redirect. This can be done by sub-classing the urllib2.HTTPRedirectHandler to get the redirect with its hashtag and token. Here is a short example of ...



Only top voted, non community-wiki answers of a minimum length are eligible