1

I'd like to ship a working example of using the explicit authentication flow in Stack.PHP. I have no trouble embedding the API key and app ID in the example. The problem lies in embedding the client secret - which is not supposed to be divulged at all.

I initially thought that using the implicit authentication flow might be the best way to ship an example - but alas, the implicit flow returns the access token in the URL's hash. PHP (being exclusively a server-side language) has no means of accessing the hash of a URL. Therefore the example cannot use the implicit flow.

What are the options available for my example?

Improve this question

1 Answer 1

Reset to default
0

At this point in the beta, there really isn't a good solution. You can't share the secret safely, nor can you instruct others to generate keys (unless they are in the beta).

However, the proper way (which will be applicable when the API is generally available) is to stub out the application specific bits and instruct consumers on how to generate them. Replacing three strings (id, key, and secret) isn't too much to ask of people trying to familiarize themselves with your library.

Improve this answer
1
  • Okay, that's what I figured and what I ended up doing. That will work fine. (In my case it's 6 strings since there are examples for both explicit and implicit authentication.)
    – Nathan Osman
    Commented Dec 14, 2011 at 0:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .