Using Oauth2, when I go to pick up the access_token, I get the following error from the server: access_denied: redirect_uri does not match the uri used to create the passed code. From what I can tell, the redirect_uri does match the one sent in the oauth request.


Request to the oauth service:


After logging in and authorizing, post_data in the request to the https://stackexchange.com/oauth/access_token service:


The response is an HTTP 400 with the error.

Comparing the redirect_uri strings:

http%3A%2F%2Fwww.noverse.com%2FOAuthStackExchangeCallback http%3A%2F%2Fwww.noverse.com%2FOAuthStackExchangeCallback

They match.

Supporting Data

  • Using the GTMOauth2 library by Google
  • Application ID is 218
  • Client Side OAuth is turned off (so I do see the redirect in the browser)
  • The domain name is noverse.com


The code is from the example in the library

The Authenticator Object

This is the object that is used to get the token and to make further secured requests

- (GTMOAuth2Authentication *)authForStackExchange
    NSURL *tokenURL = [NSURL URLWithString:@"https://stackexchange.com/oauth/access_token"];
    NSString *redirectURI = @"http://www.noverse.com/OAuthStackExchangeCallback";

    // ... snip ...

    GTMOAuth2Authentication *auth;
    auth = [GTMOAuth2Authentication authenticationWithServiceProvider:@"StackExchange" tokenURL:tokenURL redirectURI:redirectURI clientID:clientID clientSecret:clientSecret];
    return auth;

Login to StackExchange

This code starts the process by launching a web browser to enable login and authorization. It intercepts the redirect_uri and then uses the previous object to request the token.

- (void)signInToStackExchange 
    GTMOAuth2Authentication *auth = [self authForStackExchange];
    auth.scope = @"";

    // display the authentication sheet
    NSURL *authURL = [NSURL URLWithString:@"https://stackexchange.com/oauth"];

    GTMOAuth2WindowController *windowController;
    windowController = [GTMOAuth2WindowController controllerWithAuthentication:auth authorizationURL:authURL keychainItemName:kStackExchangeKeychainItemName resourceBundle:nil];

    [windowController signInSheetModalForWindow:self.window delegate:self finishedSelector:@selector(windowController:finishedWithAuth:error:)];
  • Think I found the issue, can you try again? – Kevin Montrose Apr 4 '12 at 18:06
  • Sorry for the delay - tried again - and it gets to the next step ("Authentication Succeeded"). Now I am not getting the token back from the access_token call, but I'll drill further in my code before calling it a bug. Thank you Kevin. – Hiltmon Apr 4 '12 at 21:24
  • Kevin, quick question: The response to the access_token call returns access_token=oHU0MqQMKhC4bcFM6b7HxQ))&expires=86400. Brilliant!. According to the Google library code (and other OAuth2 servers I am testing), should the expires field not be expires_in? – Hiltmon Apr 4 '12 at 22:09
  • Our OAuth 2.0 implementation is consciously patterned on Facebook (developers.facebook.com/docs/authentication/server-side , which returns expires). Technically, expires_in is only recommended in the current OAuth 2.0 draft (tools.ietf.org/html/draft-ietf-oauth-v2-25#section-5.1); I believe the whole server response has undergone significant change over various drafts. – Kevin Montrose Apr 4 '12 at 22:22
  • Thanks, I'll change the Google code to look for both and let them know. – Hiltmon Apr 4 '12 at 22:33

You must log in to answer this question.

Browse other questions tagged .