Keep getting 500 "Internal error" in requests with an access token

Question

I'm trying to fetch some data from the Stack Exchange API I have a valid access_token and registered key but I keep getting internal error as a result. Here is the request URL:

https://api.stackexchange.com/2.2/me?site=stackoverflow&access_token=Vy*iWEzkfPKHAzx7PEtJcA%2529%2529&filter=default&order=desc&sort=reputation&key=YKCpxEolLytlJiKBUCxUJg((

And the response:

{"error_id":500,"error_message":"this error has been logged","error_name":"internal_error"}

What am I doing wrong/missing?

PS: I'm working on and an Android app and doing request with retrofit.

Answer 1

It looks like you are sending a malformed access token.
Your example, Vy*iWEzkfPKHAzx7PEtJcA%2529%2529 is not of the proper form and exhibits classic URI encoding corruption.

Valid tokens all seem to be 24 characters that end in )). And ) is often encoded as %29 by browsers depending on how you get it and/or cut and paste.
')' === decodeURIComponent ('%29')

Additionally, %25 is the URI encoding of %, so your token was double URI encoded. (That's two times too many. ;)   )

---

When I send the same request, with a validly formatted token (which I have since deauthorized):
          /2.2/me?access_token=Vza4EEmVimmN4l3O9qZ87Q)) ...
I get a valid result.

When I double URI-encode the token:
          /2.2/me?site=access_token=Vza4EEmVimmN4l3O9qZ87Q%2529%2529 ...
I get the same 500 error that you got.

---

---

Note: The links above show the proper full format. Obviously, they won't work for you since I deauth'd the token (to protect my account's virginity).
You can go to the doc page, fetch your own token, and plug it into the above links and it will work.

---

---

PS: At this moment, your base token (Vy*iWEzkfPKHAzx7PEtJcA))) appears to still be valid. When I fetch the link:
          /2.2/me?site=stackoverflow&access_token=Vy*iWEzkfPKHAzx7PEtJcA))

I get a valid but empty result:

{"items":[],"has_more":false,"quota_max":10000,"quota_remaining":9998}

which suggests that there might be some security against token hijacking. :)