Unable to get access token

Question

I am trying to get a non-expiry access token, like so:

https://stackexchange.com/oauth?scope=no_expiry&redirect_uri={{some_uri}}&client_id={{some_value}}

I am repeatedly getting the error:

Application Login Failure
An error occurred while login into an application.

Error Details
error description: Cannot return to provided redirect_uri

I have tried several values for `redirect_uri, such as:

• https://www.yahoo.com/
  and
• 10.**.**.**/myscript.php

None of them seem to be working.

Answer 1

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet.

Crucial Points:

1. Do not specify a redirect_uri to any server that you do not control.
   When you use something like redirect_uri=https://www.yahoo.com/, then a third party host has you, or your user's, credentials! That page/server will see a request like:

   https://www.yahoo.com/#access_token=X0duhxxxxxxxxxxxNvfDbQ%29%29&expires=86399
   

   It can then use that access_token to do unspeakable evil.

   This is a major breach of both security and trust. _{(Frankly, if you or your app are caught doing this, lifetime bans should be issued. Legal action may even be appropriate in some cases.)}

2. The value you set for OAuth Domain must match the redirect_uri.

   So, if you use, redirect_uri=http://10.0.0.86/myscript.php,
   then you must set OAuth Domain to 10.0.0.86.

3. If you do not have your own server:

   1. Use the "implicit OAuth 2.0 flow" (Client side). Activate Enable Client Side OAuth Flow in your app's control panel.
   2. Leave Disable Desktop Application OAuth Redirect Uri unchecked.
   3. Set OAuth Domain to stackexchange.com.
   4. Use redirect_uri=https://stackexchange.com/oauth/login_success.
      
      

4. Be sure to use GET requests for implicit (client side) OAuth and POST for explicit (server-side) OAuth.

When the authentication is successful, the access_token will be in the location.hash of the redirected page. For example:

https://stackexchange.com/oauth/login_success#access_token=5bcPtLjiyuySD7WeKSo3Mw))&expires=86399