5

I'm trying to get my head around all the limits and throttles but some terminology is confusing me:

If an application does not have an access_token, then the application shares an IP based quota with all other applications on that IP. This quota is based on the key being passed by the applications; it is the max of the daily request limit for the applications involved, which by default is 10,000. This quota scheme is essentially unchanged from earlier versions of the Stack Exchange API.

Mention is made of both key and "access_token" - are they the same thing?

(So far I'm just doing random experiments with the API really so I haven't tried to register or authenticate myself or any apps I'm working on, but I do want to understand it all, especially so I can incorporate the limits and throttling rules into my API calling code.)

Improve this question
1
  • I'm starting to get the impression one is to verify my app is registered and the other is to verify I'm allowed to look at a given user's data? (So far I've had not need to look up per user data.)
    – hippietrail
    Commented Sep 10, 2012 at 6:33

1 Answer 1

Reset to default
3

key is your app key, access_token identifies a user (and a set of permissions) and is what you get at the end of an authentication flow.

Keys are not secret, for example here's what the Documentation Console's registration looks like:

enter image description here

You can find your app key by going to Manage Your Applications (in the Stack Apps homepage sidebar) and selecting one of your apps.

Access tokens are secret, you should take care never to disclose them. By default they also expire, whereas keys never change.

Improve this answer
2
  • Yes I don't have any apps yet. Just toy ones or experiments. So with access tokens, those are something a user of an app of mine would provide, not something me as the app dev would ever know, is that right?
    – hippietrail
    Commented Sep 10, 2012 at 18:08
  • 1
    @hippietrail - you get access tokens by kicking off an authentication flow. A user does have to grant them explicitly, you could store them in a database or something once you have them but you can't create them without a user's approval.
    – Kevin Montrose
    Commented Sep 10, 2012 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .