3

I'm using the Stack Exchange v2.1 API. I'm using the explicit OAuth 2.0 flow, but it seems that the access token response step does not adhere to the RFC 6749 standard. Specifically, the Stack Exchange API documentation gives the response format as follows:

This request is responded to with either an error (HTTP status code 400) or an access token of the form access_token=...&expires=1234. expires will only be set if scope does not include no_expiry, the use of which is strongly advised against unless your app truly needs perpetual access.

However, the RFC 6749 standard, section-4.1.4, defines the access token response to be in JSON format.

This inconsistency makes many OAuth2 client libraries to fail. Could you guys look into this and fix it?

Improve this question
2
  • Confirmed that the API sends back just those two parameters, in URL-search format. However, I believe Stack Exchange operates under RFC-6750, which suggests, but does not require JSON. If true, that would make this a feature request, rather than a bug.
    – Brock Adams
    Commented Jun 2, 2013 at 12:08
  • Note that on July 9th, 2017, the doc page was silently updated to provide the https://stackexchange.com/oauth/access_token/json URL as an OAuth2 option.
    – Brock Adams
    Commented Nov 1, 2018 at 22:07

1 Answer 1

Reset to default
2

I had the same problem. According to the authentication docs‡:

In order to get access_token and expires (if applicable) wrapped in a JSON object, POST to https://stackoverflow.com/oauth/access_token/json instead.


‡ Now. The Doc pages did not say this back in 2013.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .