Refer to the API Authentication doc page, where it says:
explicit grant (is) for server side applications
Also, see What is the difference between the 2 workflows? and related questions.
Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a program that can act like one -- which your Java program can be made to do.
The explicit flow can nominally be made more secure, but it is not as easy to implement and requires both a client program and a web application to be developed (and hosted) by you.
- Use the "implicit OAuth 2.0 flow" (Client side). Activate
Enable Client Side OAuth Flow
in your app's control panel.
- Leave
Disable Desktop Application OAuth Redirect Uri
unchecked.
- Set
OAuth Domain
to stackexchange.com
.
- Use
redirect_uri=https://stackexchange.com/oauth/login_success
.
- Be sure to use
GET
requests for implicit (client side) OAuth and POST
for explicit (server-side) OAuth.
When the authentication is successful, the access_token
will be in the location.hash
of the redirected page. For example:
https://stackexchange.com/oauth/login_success#access_token=5bcPtLjiyuySD7WeKSo3Mw))&expires=86399