4

I am following The implicit OAuth 2.0 flow Guide:

My client ID is 4709 while key is RoZwtHUrhMP088oVGCMlxA((

I appended my URL as:

https://stackexchange.com/oauth/dialog?client_id=4709&scope=private_info&redirect_uri=https://stackexchange.com/oauth/login_success

and trying to oauth.

And I got this URL as returned:
https://stackexchange.com/oauth/login_success#access_token=I*SJDoi6W(TUAz2BRCEzbw))&expires=86399

I notice that I*SJDoi6W(TUAz2BRCEzbw)) is the access_token.

When I try to call the request as this answer of my question .

So I call

http://api.stackexchange.com/2.2/questions/30028657/answers?site=stackoverflow&key=RoZwtHUrhMP088oVGCMlxA((&access_token=I*SJDoi6W(TUAz2BRCEzbw))&filter=!%294k-FmUi-xgG3sdSdPz*cQNNqR0A

Unfortunately, I got 403 Error:

{"error_id":403,"error_message":"key is not valid for passed access_token, token not found.","error_name":"access_denied"}

Any Idea?

1 Answer 1

4

Your second call must be https:.

You actually got an error like:

"error_id":406,
"error_message":"Access token sent over non-HTTPS request, it has been invalidated",
"error_name":"access_token_compromised"

On the first attempt.

Only subsequent attempts, with the same token, would yield the 'key' is not valid for passed 'access_token' error.

When I call:

https://stackexchange.com/oauth/dialog?client_id=4709&scope=private_info&redirect_uri=https://stackexchange.com/oauth/login_success

And get:

https://stackexchange.com/oauth/login_success#access_token=wdR8Lm7m4ibD48lfrCcFxQ))&expires=86399

and then call:

https://api.stackexchange.com/2.2/questions/30028657/answers?site=stackoverflow&key=RoZwtHUrhMP088oVGCMlxA((&access_token=wdR8Lm7m4ibD48lfrCcFxQ))&filter=!)4k-FmUi-xgG3sdSdPz*cQNNqR0A

It works for me. (Before I invalidated the token, that is. ;) )

3
  • That's exactly!
    – Zigii Wong
    May 5, 2015 at 9:43
  • So if I try second attempts, I will get a 403 error? How to avoid it cause I don't want to access a single access_token again for per request.
    – Zigii Wong
    May 5, 2015 at 9:58
  • No, you'll only get the 403 because you got the previous 406 error. Just keep everything on https: and you'll be okay. May 5, 2015 at 10:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .