Tag Info

Hot answers tagged

4

The OAuth domain name is the domain name that will be used to restrict the value of the redirect_uri parameter when authenticating from your application. This is done as a security precaution to prevent others from using your API key and redirecting to a domain name that does not match the one specified in the registration form. The API documentation page ...


4

You can register apps that aren't web apps. This page: http://api.stackexchange.com/docs/authentication, gives details for registering a Desktop Application. A mobile phone app comes under the category of a desktop application. You should use the implicit flow, so check the box at the bottom of registration form, and for the OAuth domain use: ...


3

We moved from nginx to HAProxy for our SSL provider this weekend as part of a larger rollout. In the move, we shifted our header checks to the now de-facto standard SSL protocol header. While I thought I fixed all the apps relying on the old header and standardized everything internally, stackexchange.com was left out and thought your auth requests weren't ...


2

I found answer myself and posted in my blog post StackAlert Firefox Extension error key is not valid for passed access_token Solution in brief When you remove the application from StackExchange apps, and even after uninstalling the extension from Firefox, you will still have traces of that extension in Firefox. To make this extension work again, we have ...


2

Well, my bad - I forgot to set the Content-Type header. Fixed code snippet: def oauth_explicit_two(client_id, client_secret, code, redirect_uri): params = {'client_id': client_id, 'client_secret': client_secret, 'code': code, 'redirect_uri': redirect_uri} headers = {'Content-Type': 'application/x-www-form-urlencoded'} # <--- ...


1

This is status-bydesign. You'll note on the authentication documentation: Desktop applications cannot participate directly in OAuth 2.0 flows, however the embeddable browser controls available in most frameworks make it possible to work around this limitation. Desktop applications should use the implicit client-side flow, hosting the process ...


1

If a user has any authorized applications, the apps tab appears on their profile pages. From the page linked a user can see their authorized applications, and de-authorize any of them. That link probably won't be conditionally displayed forever, but we haven't got anything to show in the "emtpy" case just yet.



Only top voted, non community-wiki answers of a minimum length are eligible